[Snort-users] conflict with rules

tony.ramard at ...13196... tony.ramard at ...13196...
Tue Mar 29 05:57:46 EST 2005


In this paper: http://www.cs.cuc.edu/~droelker/docs/RuleManager.pdf,
Roelker defines the "defined unique conflicts" (p4). I want to know how to
check one rule and not to check a set of rules.

Thanks.
Tony Ramard



Selon Hugo <hchlai at ...2792...>:

> If I understand correctly, Snort will check a packet against each rule.
> Therefore, I assume a packet can trigger multiple alerts. There can't be
> a conflict of rules... am I right?
>
> Hugo
>
> tony.ramard at ...13196... wrote:
>
> >
> >
> >i want to know, how Snort manage the conflict of rules.
> >
> >
> >-------------------------------------------------------
> >SF email is sponsored by - The IT Product Guide
> >Read honest & candid reviews on hundreds of IT Products from real
> users.
> >Discover which products truly live up to the hype. Start reading now.
> >http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> >_______________________________________________
> >Snort-users mailing list
> >Snort-users at lists.sourceforge.net
> >Go to this URL to change user options or unsubscribe:
> >https://lists.sourceforge.net/lists/listinfo/snort-users
> >Snort-users list archive:
> >http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
>
> __________________________________________________________________
> Switch to Netscape Internet Service.
> As low as $9.95 a month -- Sign up today at
> http://isp.netscape.com/register
>
> Netscape. Just the Net You Need.
>
> New! Netscape Toolbar for Internet Explorer
> Search from anywhere on the Web and block those annoying pop-ups.
> Download now at http://channels.netscape.com/ns/search/install.jsp
>






More information about the Snort-users mailing list