[Snort-users] Same source/dest

James-lists hackerwacker at ...3784...
Wed Apr 2 08:30:53 EST 2003


: 
: No...  Don't modify the rule, because if you ever update your rules your
: changes could be 'lost'.  Just write a pass rule instead.
: 


Well, thats the way I do it, and it works for me. I tend
to move modified rules out to local.rules, so I can keep
track of them. 




More information about the Snort-users mailing list