Re: Making snort smarter...

[Jason Haar <Jason.Haar () trimble co nz>]

One word of warning: if you start altering the rules so that some rules
don't apply to some hosts, you'd better make sure you *intimately*
understand everything to do with those rules and hosts and *know for sure*
that there's no way in hell that rule would ever trigger against other hosts. 

e.g. I can easily see people dropping the CGI checks for their IIS servers,
unaware that ActivePerl had been installed on them...

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users