I was hoping that someone could help me, I am running snort 1.9 on Win2K.  I got it to run and on our little moch network I can see other computers trying to get in, for example I can see a ping, or a sweep.  So I assumed that it was working.  Then I wanted to see if I could get one of my rules to work, so I added a rules text where all the other rules where, and gave it a .rules extension, I made just a simple one alert tcp <ip/24>500:2000 -> <ip/24> any.  Then in the snort config file I placed a # in front of all of the rules listed and added a path to the rule file I made.  My thinking was that I would recieve only instances that I specified where anything coming from not my computer between port 500 and 2000 trying to go to my computer by any port, but that wasn't the case, I was getting everything as I was before, comming from any port.  It seemed A.) that my rule file wasn't working, and B.) that all the rule files where activated again, WHY IS THIS.  If anyone can help me out here it would be greatly appreciated.  Thanks

Ryan