Home page logo
/

snort logo Snort mailing list archives

Re: flowbits: netsenum
From: Joel Esler <jesler () sourcefire com>
Date: Thu, 30 May 2013 14:53:45 -0400

On May 30, 2013, at 2:23 PM, waldo kitty <wkitty42 () windstream net> wrote:
On 5/30/2013 07:01, Joel Esler wrote:

On May 29, 2013, at 7:53 PM, waldo kitty<wkitty42 () windstream net>  wrote:

additionally, both existing rules' MSG are identical... one should
speak of "to client" and the other "to server" in the MSG for
clarity??

The "set" rule is noalert. You'll never see it alert.

true but perhaps someone sets them to show an alert? ;)

Is that something you do?  I'm not asking that to be a smartass, I'm asking
if that's actually a use case that I haven't studied.

we have had some folks do that so they could follow thru with the processing 
flow and the rules that are seen... it was a mess that some of them regretted 
having done and a revert of the updater's conf along with a new rules pack 
download sussed that...

at least they were smart enough to also adjust the priority to 5 or higher so 
the reactive alert blocking mechanism didn't go blocking the entire internet 
based on them ;)

I can see the context for them may be interesting, but in the grand scheme of things, I don't know if it's truly 
necessary.  I mean, if this is something that people want, I can do it, but it doesn't seem to be high on the priority 
list.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire
------------------------------------------------------------------------------
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
http://p.sf.net/sfu/appdyn_d2d_ap1
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]