Re: Restart snort inline without traffic loss?

[waldo kitty <wkitty42 () windstream net>]

On 2/8/2013 11:57, Jeremy Hoel wrote:
> Could you use modifiy.sid to do that?

not knowing pulledpork, i'm going to guess that this is exactly what i've been 
trying to point the OP towards...

in oinkmaster, i simply include another conf file that contains actual modifysid 
options along with enablesid and disablesid options ;)

> On Fri, Feb 8, 2013 at 10:06 AM, Andy<a_w_smith () yahoo co uk>  wrote:
> > Thanks, this leads to another question, can I configure dropsid.conf to
> > change alert to sdrop rather than drop when using pulledpork, I had a google
> > and didn't much?



------------------------------------------------------------------------------
Free Next-Gen Firewall Hardware Offer
Buy your Sophos next-gen firewall before the end March 2013 
and get the hardware for free! Learn more.
http://p.sf.net/sfu/sophos-d2d-feb
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!