Re: Snort rule question

[Chris Green <cmg () sourcefire com>]

James Lay <slave_tothe_box () yahoo com> writes:

> So ok....trying to catch those naughty spammers using:

->

v.

<-

> And it did not work.  Any reason the two aren't equivalent?

Marty deemed it important that rules always read from right to left.
I had patches there a long time ago that conditionally included
support to rewrite the rule before parsing but since there was no
error checking for that, rules always were -> unless you edited
config.h

After supporting people long enough, I decided about the same thing
and never fought for it again.

->
<>

are the only 2 direction operators.
-- 
Chris Green <cmg () sourcefire com>
To err is human, to moo bovine.


-------------------------------------------------------
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users