[Snort-users] Snort pass rules...

PlanAlpha plan.alpha at ...11827...
Tue May 24 11:29:30 EDT 2005


I'm having a problem with a couple of pass rules. Usually I get false
alert (in BASE), look at the sid=n, grep for the rule, paste it into
my local.rules and change alert to pass and alter the src/dst, etc....
But I'm getting some alerts on sid's without rules, like sid=2 or
sid=7. I assume these are from one or more of my plugins. How do I add
them to my local.rules or mimic that function?

Many thanks!

More information about the Snort-users mailing list