[Snort-users] Restart snort inline without traffic loss?

waldo kitty wkitty42 at ...14940...
Fri Feb 8 13:33:25 EST 2013


On 2/8/2013 11:57, Jeremy Hoel wrote:
> Could you use modifiy.sid to do that?

not knowing pulledpork, i'm going to guess that this is exactly what i've been 
trying to point the OP towards...

in oinkmaster, i simply include another conf file that contains actual modifysid 
options along with enablesid and disablesid options ;)

> On Fri, Feb 8, 2013 at 10:06 AM, Andy<a_w_smith at ...1396...>  wrote:
>> Thanks, this leads to another question, can I configure dropsid.conf to
>> change alert to sdrop rather than drop when using pulledpork, I had a google
>> and didn't much?






More information about the Snort-users mailing list