|
|
|
|
Snort Forums Archive
Archive Home » Support » how to dymanic changing RULES configuaration ,when SNORT is running ?
Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.
[ Notice: Full Version of This Topic ]
how to dymanic changing RULES configuaration ,when SNORT is running ?
Posted by Colm on April 03, 2005 09:23:39
hi :
example:
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS(msg:"WEB-ATTACKS /etc/shadowaccess";flow:to_server,established;content:"/etc/shadow";nocase; sid:1372;lasstype:web-application-activity;rev:4;)
Default $EXTERNAL_NET ==> 0.0.0.0
if I found 192.168.3.0 is ATTACKS source network,can SNORT dynamic changing $EXTERNAL_NET ==> 192.168.3.0,and no need restart SNORT ? |
|
|
|
|
|
