[Snort-users] Snort rule question

Chris Green cmg at ...1935...
Thu Jun 26 10:37:19 EDT 2003


James Lay <slave_tothe_box at ...131...> writes:

> So ok....trying to catch those naughty spammers using:

->

v.

<-

> And it did not work.  Any reason the two aren't equivalent?

Marty deemed it important that rules always read from right to left.
I had patches there a long time ago that conditionally included
support to rewrite the rule before parsing but since there was no
error checking for that, rules always were -> unless you edited
config.h

After supporting people long enough, I decided about the same thing
and never fought for it again.

->
<>

are the only 2 direction operators.
-- 
Chris Green <cmg at ...1935...>
To err is human, to moo bovine.




More information about the Snort-users mailing list