[Snort-users] Have difference sig detection in Snort 18.104.22.168 and above 2.9.3.
wkitty42 at ...14940...
Mon Dec 24 12:25:26 EST 2012
On 12/24/2012 10:09, Kiryukhin Andrey wrote:
> hi I have a problem with signature in different snort version. I had test with
> snort 22.214.171.124 , 126.96.36.199 and 2.9.4 with default configs and my sig, wich i placed
> in local.rules.
how big is each packet in the pcap that should be triggering the rule?
i'm thinking that it may be due to packet reassembly but that's a pure eWAG...
More information about the Snort-users