RE: need help understanding the "flow:" keyword

[Frank Knobbe <frank () knobbe us>]

On Wed, 2005-01-05 at 13:46 -0500, Miner, Jonathan W (CSC) (US SSA)
wrote:
> > I do have the flow preprocessor enabled, same line in snort.conf as
> > you have in your email.
> [...]
> I am running 2.3RC2... I upgraded to that yesterday.
>
> It appears that none of the flow sigs fire.

That is very strange. I'm running 2.3.0RC2 (build 9) with flow
preprocessor enabled, and my bleeding (and normal Snort rules) that
contain flow alert just fine.

Last thing to check... do you have a -z in the Snort command line? If
so, take that out and see if that makes difference.

Regards,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part