Re: Have difference sig detection in Snort 2.9.1.2 and above 2.9.3.

[waldo kitty <wkitty42 () windstream net>]

On 12/24/2012 10:09, Kiryukhin Andrey wrote:
> hi I have a problem with signature in different snort version. I had test with
> snort 2.9.1.2 , 2.9.3.1 and 2.9.4 with default configs and my sig, wich i placed
> in local.rules.

how big is each packet in the pcap that should be triggering the rule?

i'm thinking that it may be due to packet reassembly but that's a pure eWAG...

------------------------------------------------------------------------------
LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
Remotely access PCs and mobile devices and provide instant support
Improve your efficiency, and focus on delivering more value-add services
Discover what IT Professionals Know. Rescue delivers
http://p.sf.net/sfu/logmein_12329d2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!