Snort mailing list archives

Tuning snort palse positives


From: Juan Fernandez <Juan.Fernandez () deltathree com>
Date: Sun, 9 Jan 2005 12:34:11 +0200

 

Hi,

 

I wanted to ask all of you if you reached a point in snort installation in
which there aren't any false positives or negative alerts.

 

It seems that snort can't be reliable in 100% and I will always receive
wrong alerts....

 

Does any of you receive just real alerts (just alerts that indicate
penetration or attempt to penetrate the network? ).

 

I'm starting to think that snort doesn't worth all the energy and hours im
spending on it.

 

Thanks !!

 


Current thread: