about pass rule

["Ronneil Camara" <ronneilc () remingtonltd com>]

Is it just replacing the word "alert" with "pass" so that it ignores the attack?

Example.

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS cmd.exe access"; flags: A+; content:"cmd.exe"; nocase; 
classtype:web-application
-attack; sid:1002; rev:2;)

  will become

pass tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS cmd.exe access"; flags: A+; content:"cmd.exe"; nocase; 
classtype:web-application
-attack; sid:1002; rev:2;)

-o is also needed. :-)

Thanks. 

Neil

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users