Re: flowbits: netsenum

[Joel Esler <jesler () sourcefire com>]

On May 30, 2013, at 4:05 PM, waldo kitty <wkitty42 () windstream net> wrote:

> what i ran into and the reason for my original posts, was that the bits were set 
> but there was nothing to check them... no indication of a SO only rule or just a 
> forgotten or commented out standard alert rule... that's why i ran my grep to 
> find out if there was a rule disabled by default for those flowbits setters... 
> if there was and it was disabled by default, then it might either need to be 
> enabled by default or the flowbits setter rule should also be disabled by default…

And it is much appreciated it.  I love the feedback, I'm trying to make the "out of the box" policy as good as I can 
get it, if you adjust from there, that's on you.


> as far as SO rules go, i don't know about other environments but ours does not 
> use them by default... it requires specific and manual intervention to enable 
> them as well as making them work (generating the stubs in the proper place and 
> updating them when they change)... the fact that our environment it its own 
> distribution and not one of the big name brand one adds complication to the 
> process since they are distributed only in compiled form…

Well, from our perspective, we ship them in a "default" state.  If people choose not to use the SOs, or can't, then 
that's a use case we can't work around.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire


------------------------------------------------------------------------------
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
http://p.sf.net/sfu/appdyn_d2d_ap1

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!