Re: Snort rule action/plugin question

[Matt Kettler <mkettler () evi-inc com>]

No, such a plugin would quickly slow snort down to the point that it would 
cause packet drops, creating a security hole.

However, there are lots of good logwatcher tools out there that do this 
kind of thing quite effectively, and without creating a weakness in snort.

See the FAQ:

http://www.snort.org/docs/faq.html#5.7

and
http://www.snort.org/docs/faq.html#5.9


Unless a task truly needs to be completed within a few milliseconds of a 
packet arriving, it's probably better done a million times better by using 
a logwatcher than a plugin.


At 09:58 AM 7/11/2002 -0500, Clint M. Sand wrote:
> Is there a snort plugin that would allow snort to send pages or text 
> messages via modem when a rule is triggered?
>
> Thanks.
>
> Clint



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
PC Mods, Computing goodies, cases & more
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users