Re: content alerts for re-transmit packets

["Joel Esler (jesler)" <jesler () cisco com>]

We need more of a description of the problem.

https://snort.org/faq/how-do-i-ask-a-good-question-on-the-snort-list

--
Joel Esler
Manager, Talos Group




On Nov 20, 2015, at 3:23 PM, Dorian Promo <dorian.promo () gmail com<mailto:dorian.promo () gmail com>> wrote:

My match content rule only gives an alerts for the original packet not for re-transmits.
How can I change that to fire alerts on retransmits.

Thank you

snort 2.9.7.6 GRE (Build 285)
------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net<mailto:Snort-users () lists sourceforge net>
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
Go from Idea to Many App Stores Faster with Intel(R) XDK
Give your users amazing mobile app experiences with Intel(R) XDK.
Use one codebase in this all-in-one HTML5 development environment.
Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs.
http://pubads.g.doubleclick.net/gampad/clk?id=254741551&iu=/4140

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!