Re: Reputation preproc priority showing "blacklist" when set to "whitelist"
Hui cao <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi Mike, Thanks for reporting this. This is an output issue. It only outputs whitelist when whitelist means trust. When it means unblack, it outputs blacklist. It should output whitelist in both cases. Best, Hui. On 07/28/2015 01:27 PM, Mike Cox wrote: > When enabling the reputation preprocessor and not setting the > "priority" option, I see this (the default value) when Snort starts up: > > Reputation config: > ... > Reputation priority: whitelist > > However, if I set the "priority" option to "whitelist" (it can only be set to "whitelist" or "blacklist"), I get this when Snort starts up: > > Reputation config: > ... > Reputation priority: blacklist > > I have not tested to see if this is just an output issue or if it actually affects engine behaviour. However, I see this on Snort 2.9.7.3 and also now on Snort 2.9.7.5, as well as previous versions. > > Thanks. > > -Mike Cox > > > > ------------------------------------------------------------------------------ > > > _______________________________________________ > Snort-devel mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/snort-devel > Archive: > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel > > Please visit http://blog.snort.org for the latest news about Snort! ------------------------------------------------------------------------------ _______________________________________________ Snort-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!