[Snort-users] Turning off signatures

twig les twigles at ...131...
Sun Dec 21 19:37:03 EST 2003


--- Jeff Kell <jeff-kell at ...6282...> wrote:
> Hello... after the usual hassles installing
> snort/acid/MqSql/etc on 
> RedHat 9, I'm happily sniffing away.  Now to tune some
> signatures.
> 
> The FAQ just says '#' comment them out.  But that will have to
> be 
> repeated with each download of the rules(?).  Is there some
> magic I'm 
> overlooking regarding signature maintenance?
> 

Indeed.  Goto the downloads section of the snort site and grab
oinkmaster.  It's a little perl script that "remembers" which
sigs you comment out.  Small, elegant, effective.

=====
-----------------------------------------------------------
Only fools have all the answers.   
-----------------------------------------------------------

__________________________________
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
http://antispam.yahoo.com/whatsnewfree




More information about the Snort-users mailing list