Re: [snort-users] About attribute replacement

[waldo kitty <wkitty42 () windstream net>]

On 10/19/2013 9:51 AM, Mayur Patil wrote:
> Hello Sir,
>
>          The main problem is that I have to use *count* and *seconds* in DoS
> rules which I am unable to find in case of so rules.
>
>          Please give any hints how to use these options in case of shared
> objects that will be a great help to me.

SO rules are code so use your own counters and seconds for them inside your 
code... you do not need the existing options since the SO rule will do the 
counting instead of snort... you just have to have your own variables and do the 
counts yourself...

that's my understanding but perhaps someone from snort can confirm this as it 
pertains to snort SO rules...

-- 
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60135031&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!