Snort mailing list archives
Re: Disabled Rules
From: JJC <cummingsj () gmail com>
Date: Thu, 7 Jan 2016 11:33:57 -0700
It all depends on the base policy that you selected and what things you may have categorically enabled/disabled. That is not an unusual looking number to me though. JJC Sent from the iRoad
On Jan 7, 2016, at 08:23, Spencer Brewer <spencer.brewer () gmail com> wrote: Hi, when PulledPork runs it reports that I have far, far more rules disabled than enabled. Is this normal? I don't have very much in my disablesid.conf, so I'm just checking with the community to see whether or not the number if enabled and disabled rules is similar to what everyone else has. If these are not controlled through disablesid.conf, is there another place I should look for disabled rules? Rule Stats... New:-------46 Deleted:---16 Enabled Rules:----8330 Dropped Rules:----0 Disabled Rules:---19406 Total Rules:------27736 Thanks ------------------------------------------------------------------------------ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Disabled Rules Spencer Brewer (Jan 07)
- Re: Disabled Rules JJC (Jan 07)