Re: Dangerous to use custom ruletypes?

[Erek Adams <erek () snort org>]

On Wed, 14 May 2003, Martin Olsson wrote:

> Is it dangerous to use custom ruletypes?
>
> I just discovered that when you define your own ruletypes, they are put
> LAST in the chain of rules. Here is an example of the output when I run
> snort with the -o option (pass rules first):
>
>   Rule application order: ->pass->activation->dynamic->alert->log->panic

[...snip...]

Little Known Snort Tidbit #324:

        config order: panic pass activation dynamic alert log

Thank Andrew for that one.  ;-)

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara
The only event dedicated to issues related to Linux enterprise solutions
www.enterpriselinuxforum.com

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users