[Snort-users] Have difference sig detection in Snort 126.96.36.199 and above 2.9.3.
wkitty42 at ...14940...
Mon Dec 24 12:25:26 EST 2012
On 12/24/2012 10:09, Kiryukhin Andrey wrote:
> hi I have a problem with signature in different snort version. I had test with
> snort 188.8.131.52 , 184.108.40.206 and 2.9.4 with default configs and my sig, wich i placed
> in local.rules.
how big is each packet in the pcap that should be triggering the rule?
i'm thinking that it may be due to packet reassembly but that's a pure eWAG...
More information about the Snort-users