From: Esler, Joel - Contractor (joel.eslerrcert-s.army.mil)
Date: Mon Sep 13 2004 - 07:32:18 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Depends on what version of Snort you are running. Apparently Snort
2.2.0 alerts off of multiple rules.
 
Joel

-----Original Message-----
From: snort-users-adminlists.sourceforge.net
[mailto:snort-users-adminlists.sourceforge.net] On Behalf Of Dennis
George
Sent: Monday, September 13, 2004 5:44 AM
To: snort-userslists.sourceforge.net
Subject: [Snort-users] A simple question........

Hi all,
 
I think it will be simple question............ But I am slighlty
confused..........
 
1) If in my rule file I have 3 rules and in a packet all the 3 rules get
satisfied... do I get all the three alerts ??
 
2) If I have two identical rules then does snort discard one of the rule
or generate two alerts when that rule is satisfied ???
 
thanks in advance
 
Dennis

  _____

Do you Yahoo!?
Yahoo!
<http://us.rd.yahoo.com/mail_us/taglines/50x/*http://promotions.yahoo.co
m/new_mail/static/efficiency.html> Mail - 50x more storage than other
providers!

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]