Re: config order directive

[Joel Esler <joel.esler () sourcefire com>]

Is there a reason you need to change it?  The only reason you ever  
needed to change it back in the day was to put pass before alert, but  
since we've already done that for you....

putting alert first will just process alert rules before any other  
rules.  (If you have other rules, which you probably don't if this is  
a new install)

J

+---------------------------------------------------------------------+
Joel Esler                                         Security Consultant
    gpg key: http://demo.sourcefire.com/jesler.pgp.key
+---------------------------------------------------------------------+



On Mar 28, 2007, at 4:24 AM, Josep Pujadas i Jubany wrote:

> Hello!
>
> I can't find detailed information about the "config order" directive.
>
> My /var/log/messages says:
>
> # cat /var/log/messages | grep snort | grep order
> Mar 27 20:28:45 my_machine snort[1659]: Rule application order: - 
> >activation-
> > dynamic->pass->drop->alert->log
>
> Can I change it? How? Wich is the effect if I put "alert" at first  
> place?
>
> My snort is only a snort machine, so it is not actuating as a  
> firewall, only
> a sensor.
>
> Best regards,
>
> Josep Pujadas
>
> ---------------------------------------------------------------------- 
> ---
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to  
> share your
> opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php? 
> page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users