Snort mailing list archives
Re: Snort rules merging and duplicate entries (3D Linked List)
From: <scheidell () secnap net>
Date: Thu, 2 Oct 2003 14:48:28 -0400
"Jukka Juslin" <jtjuslin () hutcs cs hut fi> wrote in message news:<Pine.GSO.4.58.0310021109200.22956 () hutcs cs hut fi>...
Does somebody know, what happens if I updated rules by merging and I get two identical rules? Will I get same alert twice or does a newer rules always win (and be the only one activated)?
At the very least, if they have the same sids, and you use the new throttling in 2.02 it won't start. ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: Snort rules merging and duplicate entries (3D Linked List) scheidell (Oct 02)