Re: [Snort-sigs] general sig question

From: Erek Adams <erek(at)snort.org>
Date: Tue May 27 2003 - 19:12:21 EDT

On Tue, 27 May 2003, Tom Arseneault wrote:

> Am I reading the manual wrong? This seems to be exactly what he's

Kinda. He's asking for 'fire an alert only if there is over X of this alert. Tagging just grabs X number of packets after the first.

Cheers!

---

Erek Adams

   "When things get weird, the weird turn pro." H.S. Thompson

---

This SF.net email is sponsored by: ObjectStore. If flattening out C++ or Java code to make your application fit in a relational database is painful, don't do it! Check out ObjectStore. Now part of Progress Software. http://www.objectstore.net/sourceforge

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Tue May 27 19:48:30 2003