Re: Re: (Snort-users) Disabling rules without touching the origi

[Marcus Spading <linuxnews () fragmentum net>]

* sandro.poppi () wacker com <sandro.poppi () wacker com> [020103 07:36]:
> did you already try using pass rules? This helped me (and of course a lot of
> others too ;). Adding the command line option -o is then required. For your

Yes I already tried that one. It seemed to work, but ...

> For more information take a look on the excellent snort manual.

.. after reading the manual a third time, I decided it is safer not to use
the -o option, especially because I am relativly new to snort and I don't
want a bad crafted pass rule to throw away important alerts that otherwise
would have been logged.

-- 
BCNU
Marcus

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users