snort-devel July 2008 archive
Main Archive Page > Month Archives  > snort-devel archives
snort-devel: Re: [Snort-devel] Snort 2.8.2.1 Now Available

Re: [Snort-devel] Snort 2.8.2.1 Now Available

From: christian mock <cm_at_nospam>
Date: Wed Jul 23 2008 - 15:48:58 GMT
To: snort-devel@lists.sourceforge.net


On Tue, Jun 17, 2008 at 04:52:24PM -0400, Snort Releases wrote:

> Snort 2.8.2.1 fixes a problem in which pass rules sometimes did not take
> precedence over alert and/or drop rules.

I'm still seeing "pass" rules getting ignored with 2.8.2.1. I'm not able to reproduce it with a minimal (testcase) ruleset, but when I have a "normal" (9100 rules) ruleset with a pass rules in front, some of those are ignored, depending on the amount of pass rules present...

cm. -- Christian Mock Wiedner Hauptstr. 15 Senior Security Engineer 1040 Wien CoreTEC IT Security Solutions GmbH +43-1-5037273 ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Snort-devel mailing list Snort-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-devel