[Snort-users] Snort rule question

Chris Green cmg at ...1935...
Thu Jun 26 10:37:19 EDT 2003

James Lay <slave_tothe_box at ...131...> writes:

> So ok....trying to catch those naughty spammers using:




> And it did not work.  Any reason the two aren't equivalent?

Marty deemed it important that rules always read from right to left.
I had patches there a long time ago that conditionally included
support to rewrite the rule before parsing but since there was no
error checking for that, rules always were -> unless you edited

After supporting people long enough, I decided about the same thing
and never fought for it again.


are the only 2 direction operators.
Chris Green <cmg at ...1935...>
To err is human, to moo bovine.

More information about the Snort-users mailing list