[Snort-users] Have difference sig detection in Snort 2.9.1.2 and above 2.9.3.

waldo kitty wkitty42 at ...14940...
Mon Dec 24 12:25:26 EST 2012


On 12/24/2012 10:09, Kiryukhin Andrey wrote:
> hi I have a problem with signature in different snort version. I had test with
> snort 2.9.1.2 , 2.9.3.1 and 2.9.4 with default configs and my sig, wich i placed
> in local.rules.

how big is each packet in the pcap that should be triggering the rule?

i'm thinking that it may be due to packet reassembly but that's a pure eWAG...




More information about the Snort-users mailing list