[Snort-users] Snort 2.8.1 Release Candidate Now Available
patrik.nordlen at ...6680...
Sat Apr 5 18:33:55 EDT 2008
OK - in that case the manual is kind of misleading. From section 2.5 of the
"For rule evaluation, service information is used instead of the ports when
the protocol metadata in the rule matches the service corresponding to the
trafﬁc. If the rule doesn’t have protocol metadata, or the trafﬁc doesn’t
have any matching service information, the rule relies on the port
This way of being able to write rules based on the service, not just the port,
makes very much sense. Also the ability to make use of other context data in
rules, such as only triggering Windows alerts for Windows systems, is to my
understanding something Sourcefire are already pushing as a great advantage
in their commercial products. I guess I was hoping for Snort to make use of
that as well.
On Wednesday 26 March 2008 22.29.59 Justin Heath wrote:
> This should not affect your rule writing. However, dynamic attributes
> should help define your stream and frag policies on the fly with the
> assistance of an asset identification tool.
> On Wed, Mar 26, 2008 at 2:14 PM, Patrik Nordlén <patrik.nordlen at ...6552...680...>
> > On Wednesday 12 March 2008 16.18.26 Snort Releases wrote:
> > > Hi everybody,
> > >
> > > A release candidate version of Snort 2.8.1 is now available on
> > > snort.org, at http://www.snort.org/dl/
> > >
> > > Feature highlights:
> > >
> > > * Support for target-based attribute tables
> > [...]
> > This feature seems VERY cool and a great step forward for Snort! I
> > browsed through the manual for 2.8.1rc and found some information on how
> > the file containing the attribute tables should be formatted - however I
> > found no further information on how to actually use this new
> > functionality when writing rules. I guess this will be added in the
> > documentation before the final 2.8 comes out, but could someone in the
> > know shed some light on this until then? Also, I'm curious as to whether
> > this means all current rules will
> > soon be rewritten to use these attributes primarily.
> > Cheers,
> > Patrik
> > -------------------------------------------------------------------------
> > Check out the new SourceForge.net Marketplace.
> > It's the best place to buy or sell services for
> > just about anything Open Source.
> > http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketpl
> >ace _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-usersSnort
> >-users>list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 1390 bytes
Desc: not available
More information about the Snort-users