[Snort-users] Turning off signatures

twig les twigles at ...131...
Sun Dec 21 19:37:03 EST 2003

--- Jeff Kell <jeff-kell at ...6282...> wrote:
> Hello... after the usual hassles installing
> snort/acid/MqSql/etc on 
> RedHat 9, I'm happily sniffing away.  Now to tune some
> signatures.
> The FAQ just says '#' comment them out.  But that will have to
> be 
> repeated with each download of the rules(?).  Is there some
> magic I'm 
> overlooking regarding signature maintenance?

Indeed.  Goto the downloads section of the snort site and grab
oinkmaster.  It's a little perl script that "remembers" which
sigs you comment out.  Small, elegant, effective.

Only fools have all the answers.   

Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard

More information about the Snort-users mailing list