[Snort-users] Fwd: tuning sigs priority with modifysid

Brian bmc at ...950...
Tue Oct 31 05:44:44 EST 2006


On Mon, Oct 30, 2006 at 12:48:04PM -0500, martin wrote:
> It occured to me that  "classtype:" would override any local priority setting.
> Does that mean the only way around that is to do modifysid on
> classtype and remove it or change the classtype? Any pros/cons?

Priority is supposed to overwrite classtype.

At least, when I added priority to snort such a long time ago, that
was it did.  classtype sets the default priority, but rules can
explicit priority via the priority keyword.

Brian




More information about the Snort-users mailing list