[Snort-users] A little pass rule help

Keg snrtlst at ...2792...
Mon Apr 14 14:15:11 EDT 2003


I have 2 pass rules that I placed in local.rules: (snort started with -o)
pass ip 10.0.30.4 any -> 10.0.0.0 any
pass ip 10.0.20.6 any -> any
First should take care of cluster servers broadcasts, second takes care 
of weird ICMP redirects from Shiva device. Snort cannot be started and 
it complains about those pass rules, the moment I disable 'em snort is 
started and it works fine.
Is there a syntax problem with those pass rules?
Thanks.
-- 
Your favorite stores, helpful shopping tools and great gift ideas. 
Experience the convenience of buying online with Shop at ...2793...! 
http://shopnow.netscape.com/





More information about the Snort-users mailing list