Re: Setting Snort policy_mode

[Ricky Huang <rhuang.work () gmail com>]

On Mar 5, 2013, at 4:04 PM, Ricky Huang <rhuang.work () gmail com> wrote:

> […]
> While I understand how to start snort by hand and passing in -Q or --enable-inline-test, I would like to use 
> /etc/rc.d/ script to start up Snort on boot up.  Do I add config policy_mode:(inline | tap | inline_test) in the 
> snort.conf file?  Do I have to modify the rc.d script to add in the command line arguments?  Or…?

Upon further reading I found the answer to my question here: 
http://manual.snort.org/node16.html#SECTION00313100000000000000

policy_mode is added to snort.conf.

I have a follow-up question, the config file provided by snort.org contains no such key/field 
(http://labs.snort.org/snort/2940/snort.conf), does it by default start in "tap" mode?  (I am guessing it does…).



------------------------------------------------------------------------------
Symantec Endpoint Protection 12 positioned as A LEADER in The Forrester  
Wave(TM): Endpoint Security, Q1 2013 and "remains a good choice" in the  
endpoint security space. For insight on selecting the right partner to 
tackle endpoint security challenges, access the full report. 
http://p.sf.net/sfu/symantec-dev2dev

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!