[Snort-users] About using reject in pulledpork

JJC cummingsj at ...11827...
Mon Apr 4 18:01:49 EDT 2011


It is certainly possible.. the reason that I say you are doing it wrong is
simply because the actual other functions to modify (drop, enable, or
disable) are much more efficient.  Having said that, you can absolutely use
modifysid to change to reject!

JJC

On Mon, Apr 4, 2011 at 3:29 PM, carlopmart <carlopmart at ...11827...> wrote:

> On 04/02/2011 12:22 AM, carlopmart wrote:
> > Hi all,
> >
> > Is it possible to use "reject" instead of "drop" on some signatures?? I
> > have read modifysid.conf but says explicit "If you are attempting to
> > change rulestate (enable,drop,disable) from here then you are doing it
> > wrong, it is much more efficient to do so from within the respective
> > rulestate modification configuration files"
> >
> > Thanks.
>
> JJC, could this be possible??
>
> Thanks.
>
> --
> CL Martinez
> carlopmart {at} gmail {d0t} com
>
>
> ------------------------------------------------------------------------------
> Xperia(TM) PLAY
> It's a major breakthrough. An authentic gaming
> smartphone on the nation's most reliable network.
> And it wants your games.
> http://p.sf.net/sfu/verizon-sfdev
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20110404/b18e08d2/attachment.html>


More information about the Snort-users mailing list