Snort mailing list archives
Re: Best way to change and apply multiple rules for a certain criteria
From: waldo kitty <wkitty42 () windstream net>
Date: Fri, 12 Sep 2014 20:30:06 -0400
On 9/12/2014 11:35 AM, Rochon, Jason wrote:
Hello, I’m looking for a way to change all my rules that have “PCAnywhere” going outside, to only detect going inside.
if there is not already existing inbound rules, i would copy the rules to my local.rules file and edit them to reflect the inbound direction as well as giving them new SID numbers... in this way you'll have both inbound and outbound rules... -- NOTE: No off-list assistance is given without prior approval. Please *keep mailing list traffic on the list* unless private contact is specifically requested and granted. ------------------------------------------------------------------------------ Want excitement? Manually upgrade your production database. When you want reliability, choose Perforce Perforce version control. Predictably reliable. http://pubads.g.doubleclick.net/gampad/clk?id=157508191&iu=/4140/ostg.clktrk _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Best way to change and apply multiple rules for a certain criteria Rochon, Jason (Sep 12)
- Re: Best way to change and apply multiple rules for a certain criteria waldo kitty (Sep 12)