[Snort-users] flow rule

Matt Kettler mkettler at ...4108...
Tue Sep 30 08:52:04 EDT 2003


At 05:44 PM 9/29/2003, Tantravahi Venkata Aditya wrote:
>ABout the flow rule
>
>What are the differences between the option to_client and from server


to_client and from_server are the same, however you could say it matter of 
style which one you use.

In some rules you might want to use "from_server" just to imply that it's 
exploits against the server you are concerned about. "to client" generally 
implies you're concerned about exploit against the client. However, they 
are interchangeable, and the difference will only be in the eyes of a human 
reading the rule.





More information about the Snort-users mailing list