alert never triggers

["Sheahan, Paul (PCLN-NW)" <Paul.Sheahan () priceline com>]

I am trying to check for instances where Remotely Possible connections occur
on my network. I researched the correct protocol and port being used
(tcp:799) and even used a sniffer to confirm. If destination port is 799,
then someone initiated a Remotely Possible session. If the source port is
799, then the RP session is already established and this is a response from
the host. I put the following two rules in a file called my.rules which is
the first include in snort.conf. I make RP connections all day but they
never generate the alert. These are the alerts I use:

alert tcp any any -> any 799 (msg:"RP session initiated port 799";)
alert tcp any 799 -> any any (msg:"RP session established port 799";)

Does anyone have an idea why this wouldn't work? All of my other alerts in
my.rules seem to alert properly.

Thanks for the help!
Paul

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users