Snort mailing list archives

RE: Multiple Win32 occurances?


From: "Michael Steele" <michaels () winsnort com>
Date: Tue, 25 Nov 2003 18:18:02 -0800

If this is a real production sensor then it might be wise to move any kind
of developing away from it.

My experience has shown this to be unstable in a production environment.

Cheers...

-Michael Steele
-- 
 System Engineer / Security Support Technician     
 mailto:michaels () winsnort com    
 Website: http://www.winsnort.com
 Snort: Open Source Network IDS - http://www.snort.org

-----Original Message-----
From: snort-users-admin () lists sourceforge net [mailto:snort-users-
admin () lists sourceforge net] On Behalf Of Paul Schmehl
Sent: Tuesday, November 25, 2003 5:42 PM
To: snort-users () lists sourceforge net
Subject: RE: [Snort-users] Multiple Win32 occurances?

--On Tuesday, November 25, 2003 4:54 PM -0800 Michael Steele
<michaels () winsnort com> wrote:

Why?

One instance is the "main" snort engine.  The second is used for
experimenting with new rules and new keywords (such as thresholding)
before
introducing them to the "real" snort.  The "special" snort db can be
dropped and recreated as often as I want, but the "real" one remains as an
archive.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu


-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?  SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users





-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?  SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: