RE: Pass Rule & Mail Alert

["Brian Gregorcy" <bgregor () dcti com>]

When you start snort use to -o switch, so that pass rules are read first.
You may want to take a look at the faq it has many answers like this.
  -----Original Message-----
  From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net]On Behalf Of Jayan
  Sent: Tuesday, August 26, 2003 6:35 AM
  To: Snort-users () lists sourceforge net
  Subject: [Snort-users] Pass Rule & Mail Alert


  Hi,
         I have written a pass rule named pass.rule and i have kept it as
the last entry in the snort.conf.But i find it is not working the IP which i
had mentioned to pass inspite of generating alert is not happening.What else
should i do to configure the pass rule.I wanted to send the alert generated
to a mail-id how to configure that.Can any one please tell about this its
very crucial for me.


  Thanks & Regards
  K.Jayachandran