Snort mailing list archives

Fwd: config order directive


From: Joel Esler <joel.esler () sourcefire com>
Date: Wed, 28 Mar 2007 15:36:34 -0400


+---------------------------------------------------------------------+
Joel Esler                                         Security Consultant
    gpg key: http://demo.sourcefire.com/jesler.pgp.key
+---------------------------------------------------------------------+



Begin forwarded message:

From: "Josep Pujadas i Jubany" <josep () bellera cat>
Date: March 28, 2007 12:44:38 PM EDT
To: Joel Esler <joel.esler () sourcefire com>
Subject: Re: [Snort-users] config order directive
X-Mailer: Open WebMail 2.32 20040525

On Wed, 28 Mar 2007 08:57:20 -0400, Joel Esler wrote
Is there a reason you need to change it? The only reason you ever needed
to change it back in the day was to put pass before alert, but since we've
already done that for you....

putting alert first will just process alert rules before any other rules.
(If you have other rules, which you probably don't if this is a new install)

+-------------------------------------------------------------------- -+

Joel,

No special reason to change it. I was just thinking if it would be useful
for me.

Thanks for your explanation. I understand the order is important, but the
default order is ok.

Regards,

Josep Pujadas


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Current thread: