Re: Can't alert on most

[Carlos G Mendioroz <tron () acm org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

waldo kitty @ 04/03/2014 20:38 -0300 dixit:
> On 3/4/2014 2:36 PM, Michael Wisniewski wrote:
> > Thanks for the response.  I might try another version of Snort to
> > see if this fixes the problem.
>
> doubtful since 2.9.6.0 is the latest version ;)

Well, that would be the case if we (humans) were perfect at coding...
I guess we all agree we are not, right ? :)

I also have a new setup that other than 2 false positives, is silent.
So I guess there's something we are doing (in some sense, novice Snort
installers running 2.9.6) that make our installations not effective.

I'm reluctant to go back. Because I would learn nothing by so doing. I
already know that it's not working, and was working before.

Not using PP seems a common factor too.

- -- 
Carlos G Mendioroz  <tron () acm org>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (MingW32)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlMW+l4ACgkQ7qM4U9dTH384lwCfckrGxiA4vDCl15Q3lJ4hfTYU
z4IAn08oLolu3K20ltaz+QfcbY1UnxE3
=9sfY
-----END PGP SIGNATURE-----

------------------------------------------------------------------------------
Subversion Kills Productivity. Get off Subversion & Make the Move to Perforce.
With Perforce, you get hassle-free workflows. Merge that actually works. 
Faster operations. Version large binaries.  Built-in WAN optimization and the
freedom to use Git, Perforce or both. Make the move to Perforce.
http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!