Snort mailing list archives

Re: Pulled Pork Not Enableing ET Rules


From: Eoin Miller <eoin.miller () trojanedbinaries com>
Date: Fri, 20 May 2011 20:14:48 +0000

On 5/20/2011 8:13 PM, JJC wrote:
Actually, the default behavior should be to leave the rules in the state that they were in in the original source files. Of course if you specify a security policy base (Security, Balanced, Connectivity) then it will modify the rulestate based on the metadata.

JJC


    Just put what you want to omit into the ignore list, otherwise the
    default behavior is to enable the rule.

    -- Eoin


Meant to say rules file. Not sid specifically.


-- Eoin
------------------------------------------------------------------------------
What Every C/C++ and Fortran developer Should Know!
Read this article and learn how Intel has extended the reach of its 
next-generation tools to help Windows* and Linux* C/C++ and Fortran 
developers boost performance applications - including clusters. 
http://p.sf.net/sfu/intel-dev2devmay
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Current thread: