[Snort-users] snort 1.8.4 rule question

Chris Green cmg at ...950...
Mon Mar 4 13:04:14 EST 2002


Sam <sam at ...5202...> writes:

> Greetings..
>
> I remember reading about a new feature in snort 1.8.4-beta(x) that
> would allow you to specify a rule be matched if it was to_server, or
> something to that nature.  It seemed like it would cut down on a lot
> of false positives but I can't find any documentation about it.

It will only be in the HEAD branch of snort and not in 1.8.4.  1.8.4
is bugfixes over 1.8.3 and not new features.  We're going to be
pushing the stable branch on the backburner and only fix bugs while
all the new fun stuff goes into the development branch.

>
> Sorry for the lack of description here, anyone played with this new
> feature (if it exists..  maybe it was in my dreams.. :) )

It's there but only in the development branch
-- 
Chris Green <cmg at ...950...>
"Yeah, but you're taking the universe out of context."




More information about the Snort-users mailing list