[Snort-users] Have difference sig detection in Snort and above 2.9.3.

waldo kitty wkitty42 at ...14940...
Mon Dec 24 12:25:26 EST 2012

On 12/24/2012 10:09, Kiryukhin Andrey wrote:
> hi I have a problem with signature in different snort version. I had test with
> snort , and 2.9.4 with default configs and my sig, wich i placed
> in local.rules.

how big is each packet in the pcap that should be triggering the rule?

i'm thinking that it may be due to packet reassembly but that's a pure eWAG...

More information about the Snort-users mailing list