[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oisf-users
Subject:    [Oisf-users] flowint br0ken ?
From:       Edward_Fjellskål <edwardfjellskaal () gmail ! com>
Date:       2011-12-30 8:20:15
Message-ID: 4EFD743F.6090404 () gmail ! com
[Download RAW message or body]


Hi,

My flowint rules seems to have stopped working.
(Using 1.1.1)

Example:

alert ip any any -> any any (msg:"TEST SET"; flowint:test,+,1; 
classtype:not-suspicious; sid:100; rev:1;)
alert ip any any -> any any (msg:"TEST FIRE"; flowint:test,>,0; 
classtype:not-suspicious; sid:101; rev:1;)


None of them fire.

Can anyone else confirm this?

E
_______________________________________________
Oisf-users mailing list
Oisf-users@openinfosecfoundation.org
http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
[prev in list] [next in list] [prev in thread] [next in thread]