Re: snort 1.8.4 rule question

[Chris Green <cmg () snort org>]

Sam <sam () neuroflux com> writes:

> Greetings..
>
> I remember reading about a new feature in snort 1.8.4-beta(x) that
> would allow you to specify a rule be matched if it was to_server, or
> something to that nature.  It seemed like it would cut down on a lot
> of false positives but I can't find any documentation about it.

It will only be in the HEAD branch of snort and not in 1.8.4.  1.8.4
is bugfixes over 1.8.3 and not new features.  We're going to be
pushing the stable branch on the backburner and only fix bugs while
all the new fun stuff goes into the development branch.

> Sorry for the lack of description here, anyone played with this new
> feature (if it exists..  maybe it was in my dreams.. :) )

It's there but only in the development branch
-- 
Chris Green <cmg () snort org>
"Yeah, but you're taking the universe out of context."

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users