Re: Unable to get Pass rules to ignore some traffic .

["Andrew R. Baker" <andrewb () sourcefire com>]

Moyer, Shawn wrote:
> Actually, I'm wondering if it's b/c of the "msg:" field being left in the
> rule, maybe it's still logging even if it's passing? 

Having the "msg:" field specified for a log or pass rule will not affect 
how the rule functions.  It will just not get used for that particular rule.

> I have quite a few rules that don't have the slash notation on the end and
> they work -- I'm guessing the default if CIDR is not defined is to append
> /32.

You are correct, if there is not CIDR block specified, it defaults to /32.


Of course, knowing these things still does not explain why Snort is not 
properly applying the pass rule.

-A



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users