Snort mailing list archives
Tuning snort palse positives
From: Juan Fernandez <Juan.Fernandez () deltathree com>
Date: Sun, 9 Jan 2005 12:34:11 +0200
Hi, I wanted to ask all of you if you reached a point in snort installation in which there aren't any false positives or negative alerts. It seems that snort can't be reliable in 100% and I will always receive wrong alerts.... Does any of you receive just real alerts (just alerts that indicate penetration or attempt to penetrate the network? ). I'm starting to think that snort doesn't worth all the energy and hours im spending on it. Thanks !!
Current thread:
- Tuning snort palse positives Juan Fernandez (Jan 09)
- <Possible follow-ups>
- RE: Tuning snort palse positives Ron Jenkins (Jan 09)