From: ipwitch (ipwitchunixcluster.dk)
Date: Thu Apr 10 2003 - 18:45:05 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

-----BEGIN PGP SIGNED MESSAGE-----

On Friday 11 April 2003 00:08, David Alonso De La Vega Tapage wrote:
> To ignore ALL ICMP traffic from host <foo> using a pass rule:
>
> pass icmp <foo> any -> $HOME_NET any
>
> And you _MUST_ start snort with the '-o' parameter for the pass rule to
> work correctly.
>
>
> where is the place to put this rule .. ? inside of snort.conf file ..
> or in other file .. apart .. ?

rules.local
check the bottom of snort.conf, there you can see which files snorts reads
rules from....

- --
public key: http://unixcluster.dk/public.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (FreeBSD)

iQCVAwUBPpYCAVHydoME146BAQGiWQQAsx9zhfJbNM3G52cQpRmmhdeto5g6/3Gp
w3new87iLAADCyqdb3iRmZHOc+YHbifloE0WHdwlnl5JB/nX6yJPpBOpuvoaszwc
waFiaypuzPz6vxYr0b9qnda1YZLHE1mfhq2QGqLbanRuMpF7TTrLCUTl+HSEejc3
6Pt6uJVXVRA=
=pH3h
-----END PGP SIGNATURE-----

-------------------------------------------------------
This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger
for complex code. Debugging C/C++ programs can leave you feeling lost and
disoriented. TotalView can help you find your way. Available on major UNIX
and Linux platforms. Try it free. www.etnus.com
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]