[Snort-users] Snort rule firing on another port

Anthony Rees arees734 at ...11827...
Thu Dec 13 13:27:10 EST 2012


Hi,

Vrt have a rule 1:16606, it should fire on port 443 but its firing on 3801. there is one content match in the packet, but shouldnt it ignore the rule if the header does not meet the criteria??

All aspects of the rule look good, just wondering why it doesn't ignore the packets as the rule header doesn't match.

Thanks

Sent from my iPhone




More information about the Snort-users mailing list