OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
[Snort-users] Another Snort Rules Question

From: Scott Elgram (SElgramverifpoint.com)
Date: Tue Sep 07 2004 - 18:38:31 CDT

Hello again,
    I have 2 rules....(yes this is pointless and bad practice, I know, just bare with me here).

alert icmp 192.168.0.31 any -> 192.168.0.240 any (msg: "Test ICMP ping 1";)
alert icmp 192.168.0.31 any -> 192.168.0.240 any (msg: "Test ICMP ping 2";)

    Ok, I am 192.168.31 and I ping 192.168.0.240........In ACID I get 2 alerts. One for msg: "Test ICMP ping 1" and one for "Test ICMP ping 2". Now, I could be wrong here but I thought after a packet is shown true to a rule Snort stops comparing the packet to rules.

-Scott

-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users