Snort mailing list archives
Re: [snort-users] About attribute replacement
From: waldo kitty <wkitty42 () windstream net>
Date: Sat, 19 Oct 2013 16:23:26 -0400
On 10/19/2013 9:51 AM, Mayur Patil wrote:
Hello Sir, The main problem is that I have to use *count* and *seconds* in DoS rules which I am unable to find in case of so rules. Please give any hints how to use these options in case of shared objects that will be a great help to me.
SO rules are code so use your own counters and seconds for them inside your code... you do not need the existing options since the SO rule will do the counting instead of snort... you just have to have your own variables and do the counts yourself... that's my understanding but perhaps someone from snort can confirm this as it pertains to snort SO rules... -- NOTE: No off-list assistance is given without prior approval. Please keep mailing list traffic on the list unless private contact is specifically requested and granted. ------------------------------------------------------------------------------ October Webinars: Code for Performance Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60135031&iu=/4140/ostg.clktrk _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- [snort-users] About attribute replacement Mayur Patil (Oct 18)
- Re: [snort-users] About attribute replacement Joel Esler (Oct 18)
- Re: [snort-users] About attribute replacement Mayur Patil (Oct 18)
- Re: [snort-users] About attribute replacement Mayur Patil (Oct 19)
- Re: [snort-users] About attribute replacement waldo kitty (Oct 19)
- Re: [snort-users] About attribute replacement Mayur Patil (Oct 18)
- Re: [snort-users] About attribute replacement Joel Esler (Oct 18)