Re: ROFL (me too)

[Jim Forster <jforster () rapidnet com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

"Suck" or not, many of us prefer to see what kind of garbage is coming into 
or out of our network using them.
And agreed, that is why they are disabled by default...  Otherwise the 
number of falses generated would panic most of the new snorters out there 
thinking they were the target of some massive attack. (Kind of like the 
daily E-mails I use to get saying "www.snort.org is attacking me!")   :P

At 07:48 AM 11/28/2001, Brian wrote:
> According to Ryan Russell:
> > This is something that drives us nuts on the ARIS project.  Some of the
> > signatures will go off when discussing the signature.  So, someone
> > discusses . s c r on this list, and all of the subscribers (who all run
> > Snort, naturally) suddenly have the rule go off.
>
> Again, one of the reasons that virus.rules is disabled by default.
>
> Cause they suck.
>
> --
> Save the whales.  Collect the whole set.

- -----------------------------------------------------
Jim Forster
Network Administrator
RapidNet, A Golden West Company
- -----------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>

iQA/AwUBPAUPIom0Gn1R8/mJEQKYgwCgyRdxmemm8nqsnbu0wt26HTbKk+gAoK+P
MthUc+YZh5Hi7DZsZyUJHsdn
=KZSz
-----END PGP SIGNATURE-----


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users