Re: Update to previous e-mail

[Matt Kettler <mkettler () evi-inc com>]

At 03:10 PM 11/3/2003, Kaplan, Andrew H. wrote:
> alert tcp any any -> [any,10.10.0.0/24] any

Um.. what's the purpose of that? It is functionally the same as:

alert tcp any any -> any any

And that's significantly more legible.

> While these lines were uncommented, I would get an enormous amount of alerts
> from the 10.10.0.0 subnet
> even though subsequent pass rules told snort to let pass any and all ip, tcp,
> and udp traffic on any port.

Did you pass the -o option to snort? If you don't pass -o then all alert 
rules will execute before all pass rules, without regard for what order 
they are placed in the file. Thus, in the default scenario, pass rules do 
absolutely nothing to prevent alerts.

There is ALWAYS a precedence relationship between types of rules in snort.. 
you can never use file locations to cause ordering of different kinds of 
rules.

Default is rule order is alert first, pass second, log third. If you use -o 
the order becomes pass, alert, log.  



-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?   SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users