Re: What is ruletype type good for?

[carold () gmx net]

> On Fri, 5 Jul 2002 carold () gmx net wrote:
>
> > Assuming I got this right, the sole meaning is that "type alert" in
> > "ruletype" _enables_ (or _allows for_) output alert_<whatever> options?
> > Namely, the meaning is _not_: "this is an alert rule".
>
> The way I see it--And as usual, someone please step in if I'm off base:
>
>       Alerts--When you define something as an alert, two things happen.
> Snort knows which 'tree' to place it in, and snort sends the packet thru
> the
> 'Alert' channels.  Now, as a feature of coding, the 'Alert' channels also
> make
> calls out to the 'Logs' channel.  So when something is 'Alerted on' it's
> also
> logged.
>
>       Logs--Works the same as an Alert, except that the packet never goes
> thru the 'Alert' channel.  It just gets logged.
>
> Am I answering your questions?  I sure hope so, since I've got a feeling
> I'm
> "just not getting" what you're asking.  :-(

Maybe this will explain it: I completely agree with your statements above.
Where we differ and what puzzles me is if I define custom rule class (using
"ruletype" definition) and explicitly declare it as "type alert" then I would
expect rules of this class to be treated just like a any other alert (with the
exception of customized alert and log outputs). Namely, I would expect these
rules to be of the same processing priority as other alerts.

Since this is not the case and these rules are in fact processed last then
the _only_ differentiator between declaring this class as "type alert" or
"type log" is the availability of the alert output. Going back to my original
wording: "type alert" in "ruletype" will NOT give me true alert rule (with
customized output) but merely a "last-in-the-food-line" rule with access to alert
output plugins.

I see a lot of value for true alert rules with customized output but not
much value for the current functionality. Why would I need alert output plugins
for rules that are processed last?

Perhaps the best long-term approach would be to let each user define both
output plugins and processing priority for each rule class, as opposed to the
current limited "-o" functionality.   :-O

-- 
GMX - Die Kommunikationsplattform im Internet.
http://www.gmx.net



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
We have stuff for geeks like you.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users