[Snort-users] 802.1q Monitoring

Chris Green cmg at ...1935...
Fri Jun 6 08:22:02 EDT 2003


"Ron Shuck" <rshuck at ...6736...> writes:

> BTW, can you give me any feedback on the problem I see with changing
> rule order causing some alerts not to fire. I posted a while back. I
> have had several people tell me they see similar results, but I haven't
> seen anything in users or devel lists.

Rule ordering is very much under documented in snort 2.0.  Lots of
changes have been done to the current CVS version to get the rule
ordering back.  Do you mind trying that out and seeing where that
fails you?  I see your posts were all about 2.0.0.

Thanks,
Chris
-- 
Chris Green <cmg at ...1935...>
Laugh and the world laughs with you, snore and you sleep alone.




More information about the Snort-users mailing list