Re: 802.1q Monitoring

[Chris Green <cmg () sourcefire com>]

"Ron Shuck" <rshuck () Buchanan com> writes:

> BTW, can you give me any feedback on the problem I see with changing
> rule order causing some alerts not to fire. I posted a while back. I
> have had several people tell me they see similar results, but I haven't
> seen anything in users or devel lists.

Rule ordering is very much under documented in snort 2.0.  Lots of
changes have been done to the current CVS version to get the rule
ordering back.  Do you mind trying that out and seeing where that
fails you?  I see your posts were all about 2.0.0.

Thanks,
Chris
-- 
Chris Green <cmg () sourcefire com>
Laugh and the world laughs with you, snore and you sleep alone.


-------------------------------------------------------
This SF.net email is sponsored by:  Etnus, makers of TotalView, The best
thread debugger on the planet. Designed with thread debugging features
you've never dreamed of, try TotalView 6 free at www.etnus.com.
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users