next up previous contents
Next: Configuring Up: Configuring Snort Previous: Preprocessor Events   Contents

Decoder and Preprocessor Rules

Decoder and preprocessor rules allow one to enable and disable decoder and preprocessor events on a rule by rule basis. They also allow one to specify the rule type or action of a decoder or preprocessor event on a rule by rule basis.

Decoder config options will still determine whether or not to generate decoder events. For example, if config disable_decode_alerts is in snort.conf, decoder events will not be generated regardless of whether or not there are corresponding rules for the event. Also note that if the decoder is configured to enable drops, e.g. config enable_decode_drops, these options will take precedence over the event type of the rule. A packet will be dropped if either a decoder config drop option is in snort.conf or the decoder or preprocessor rule type is drop. Of course, the drop cases only apply if Snort is running inline. See doc/README.decode for config options that control decoder events.



Subsections

Eugene Misnik 2013-05-08