[Snort-users] aim rule

Bryan Irvine bryan.irvine at ...9066...
Tue Jul 15 15:33:18 EDT 2003

What's the best way to capture both sides of an AIM session?

I'm assuming I need to change flow to also include to server...?
Do I need to make a seperate rule for that?


More information about the Snort-users mailing list