[Snort-users] Snort rule question
cmg at ...1935...
Thu Jun 26 10:37:19 EDT 2003
James Lay <slave_tothe_box at ...131...> writes:
> So ok....trying to catch those naughty spammers using:
> And it did not work. Any reason the two aren't equivalent?
Marty deemed it important that rules always read from right to left.
I had patches there a long time ago that conditionally included
support to rewrite the rule before parsing but since there was no
error checking for that, rules always were -> unless you edited
After supporting people long enough, I decided about the same thing
and never fought for it again.
are the only 2 direction operators.
Chris Green <cmg at ...1935...>
To err is human, to moo bovine.
More information about the Snort-users