snort3: How to disable rule processing ordering?

Hi,

I'm trying to use snort3 for inline L4 filtering. (snort3-3.1.18.0)
The user manual says:
"string alerts.order = pass drop alert log: change the order of rule
action application"
Is it possible to disable rule action ordering completely?

For example;
# need for first block, then alert
block icmp any any -> 8.8.8.8 any (msg: "first block"; sid: 1; )
alert icmp any any -> any any (msg: "allow + log icmp"; sid: 2; )
# need for first alert then block
alert tcp 192.168.1.0/24 any -> any any (msg: "allow+log tcp 24 bit
subnet"; sid: 3; )
block tcp 192.168.0.0./16 any -> any any (msg: "block tcp 16 bit
subnet"; sid: 4; )
# implicit rule
block ip any any -> any any (msg: "last implicit rule", sid: 100 )

Snort, sorts the rules; so that it's not working as expected.
Is there a way to make this ruleset work ?

Thanks, regards
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette