Pass rule help

["Sheahan, Paul (PCLN-NW)" <Paul.Sheahan () priceline com>]

This is my first attempt at writing a pass rule so I thought I would post a
message for a tip or two.

Occasionally I send emails directly from my Snort server which tends to set
off alarms. I want to pass all mail traffic from the snort server to the
mail server with a rule such as:

pass snortserver any -> mailserver 25

My questions are as follows:

1. What rules file to place this pass statement in
2. Where in the rules file should it be placed (before or after the alert
statements)
3. Does it matter where or in what order I place this rules file in
snort.conf?

Thanks for helping us newbies out!

Paul


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users