snort-devel July 2008 archive
Main Archive Page > Month Archives  > snort-devel archives
snort-devel: Re: [Snort-devel] Snort Now Available

Re: [Snort-devel] Snort Now Available

From: christian mock <cm_at_nospam>
Date: Wed Jul 23 2008 - 15:48:58 GMT

On Tue, Jun 17, 2008 at 04:52:24PM -0400, Snort Releases wrote:

> Snort fixes a problem in which pass rules sometimes did not take
> precedence over alert and/or drop rules.

I'm still seeing "pass" rules getting ignored with I'm not able to reproduce it with a minimal (testcase) ruleset, but when I have a "normal" (9100 rules) ruleset with a pass rules in front, some of those are ignored, depending on the amount of pass rules present...

cm. -- Christian Mock Wiedner Hauptstr. 15 Senior Security Engineer 1040 Wien CoreTEC IT Security Solutions GmbH +43-1-5037273 ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world _______________________________________________ Snort-devel mailing list