Is it possible to just use one of these directories and still have psad and
fwsnort work properly?


I was thinking of using /etc/fwsnort/snort_rules and set psad's config
parameter to:

   SNORT_RULES_DIR             /etc/fwsnort/snort_rules;

Consolidating will ease the work in having to maintain two sets of

I did see one file,  /etc/psad/snort_rules/reference.config, that's not in

I reviewed the files in each directory using the diff command and I did see
some differences, but the difference is in a comment:

  [r...@dev2 ~]# diff /etc/psad/snort_rules/telnet.rules
  < # $Id: telnet.rules 1539 2006-05-29 02:44:04Z mbr $
  > # $Id: telnet.rules 270 2006-06-27 03:05:09Z mbr $

Gil Vidals / President <> - ESX Hosting
t. 760.480.4942 f. 760.480.8271
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day 
trial. Simplify your report design, integration and deployment - and focus on 
what you do best, core application coding. Discover what's new with 
Crystal Reports now.
psad-discuss mailing list

Reply via email to