Re: Reputation preproc priority showing "blacklist" when set to "whitelist"
Mike Cox <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <CANXgGSJvfuPVe=ND93bh75VM_y7fVKyPT=DbjriGsFv+6mTYkQ@mail.gmail.com> |
Ah, OK, thanks. I had whitelist set to unblack. -MIke Cox On Tue, Jul 28, 2015 at 1:54 PM, Hui cao <[email protected]> wrote: > Hi Mike, > > Thanks for reporting this. This is an output issue. It only outputs > whitelist when whitelist means trust. When it means unblack, it outputs > blacklist. It should output whitelist in both cases. > > Best, > Hui. > > > On 07/28/2015 01:27 PM, Mike Cox wrote: > > When enabling the reputation preprocessor and not setting the "priority" > option, I see this (the default value) when Snort starts up: > > Reputation config: > ... > Reputation priority: whitelist > > > However, if I set the "priority" option to "whitelist" (it can only be set to "whitelist" or "blacklist"), I get this when Snort starts up: > > Reputation config: > ... > Reputation priority: blacklist > > > I have not tested to see if this is just an output issue or if it actually affects engine behaviour. However, I see this on Snort 2.9.7.3 and also now on Snort 2.9.7.5, as well as previous versions. > > > Thanks. > > > -Mike Cox > > > > > ------------------------------------------------------------------------------ > > > > _______________________________________________ > Snort-devel mailing [email protected]://lists.sourceforge.net/lists/listinfo/snort-devel > Archive:http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel > > Please visit http://blog.snort.org for the latest news about Snort! > > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > Snort-devel mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/snort-devel > Archive: > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel > > Please visit http://blog.snort.org for the latest news about Snort! > ------------------------------------------------------------------------------ _______________________________________________ Snort-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!