Snort mailing list archives
Re: A simple question........
From: Pedro Fortuna <pedro.fortuna () gmail com>
Date: Mon, 13 Sep 2004 12:02:59 +0100
Hello, 1) In these cases, only the highest priority rule will generate an alert. 2) I dont know the answer for sure, but my guess is: - if the two rules are equal except for the SID, you'll get two alerts - if the two rules are completly equal (SID included), you'll get an error on snort start. -Pedro Fortuna ----- Original Message ----- From: Dennis George <easyeinfo () yahoo com> Date: Mon, 13 Sep 2004 02:44:08 -0700 (PDT) Subject: [Snort-users] A simple question........ To: snort-users () lists sourceforge net Hi all, I think it will be simple question............ But I am slighlty confused.......... 1) If in my rule file I have 3 rules and in a packet all the 3 rules get satisfied... do I get all the three alerts ?? 2) If I have two identical rules then does snort discard one of the rule or generate two alerts when that rule is satisfied ??? thanks in advance Dennis ________________________________ Do you Yahoo!? Yahoo! Mail - 50x more storage than other providers! ------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- A simple question........ Dennis George (Sep 13)
- Re: A simple question........ Pedro Fortuna (Sep 13)
- Re: A simple question........ Dennis George (Sep 13)
- Re: A simple question........ Dennis George (Sep 14)
- Re: A simple question........ Jason (Sep 14)
- Re: A simple question........ Martin Roesch (Sep 16)
- Re: A simple question........ Dennis George (Sep 13)
- Re: A simple question........ Pedro Fortuna (Sep 13)
- <Possible follow-ups>
- RE: A simple question........ Esler, Joel - Contractor (Sep 13)