Re: Dangerous to use custom ruletypes?

[Martin Olsson <elof () sentor se>]

On Wed, 14 May 2003, Erek Adams wrote:
> > Is it dangerous to use custom ruletypes?
> > I just discovered that when you define your own ruletypes, they are put
> > LAST in the chain of rules. Here is an example of the output when I run
> > snort with the -o option (pass rules first):
> >   Rule application order: ->pass->activation->dynamic->alert->log->panic
> [...snip...]
>
> Little Known Snort Tidbit #324:
>       config order: panic pass activation dynamic alert log
> Thank Andrew for that one.  ;-)

Ah! Yes, thank you Andrew and Erek. I was getting really worried here...

Hmmm, maybe this should be in the manual, one think.

--
Martin Olsson
Sentor AB, Sweden



-------------------------------------------------------
Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara
The only event dedicated to issues related to Linux enterprise solutions
www.enterpriselinuxforum.com

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users