Snort mailing list archives

Changing a Classification


From: "Graham, Robert" <rgraham () mem-ins com>
Date: Wed, 15 Jan 2003 12:31:15 -0600

I created a new classification to replace "kickass-porn" with a
classification of just "Porn".  I gave it a description and priority and
changed the classtype to Porn in the signatures and restarted snort.  The
result of this caused some signatures to classify it as "Porn" and some to
classify it as "kick-Ass Porn".  I double checked the classtype and they are
all set to "Porn".  I then deleted the "kickass-Porn" classification,
restarted snort, and now it reports some of the porn alerts as
classification "-" and others as "Porn".  What I'm I doing wrong?

Current thread: