I believe that activate/dynamic rules are still an option in the
current release. You can read about these in the manual:
http://www.snort.org/docs/snort_manual/node16.html. Note, however,
that these may not be around in future releases.
On Sun, 29 Aug 2004 09:02:43 +0200 (CEST), Chris Kronberg
<smil@agleia.de> wrote:
Hi,
I'm trying to find a way to write rules provding the following:
Rule1 fires and sets another rule active, which fires on the
following traffic (if the criteria are met). Rule2 should never
fire without rule1 firing first.
First I thought, I can do that with tagging but it seems that
tagging only allows me to save more of the triggered connection
for a later analysis (which is a fine thing in itself).
Is there any way to accomplish something like that?
Cheers,
Chris Kronberg.
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
