Project

General

Profile

Actions
Copy link

Feature #6831

open

Snort does not support aliases containing FQDN

Added by Louis-Philippe Allard about 8 years ago. Updated over 4 years ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
Snort
Target version:
-
Start date:
09/29/2016
Due date:
% Done:

0%

Estimated time:
Plus Target Version:

Description

Snort does not support aliases containing FQDN. The pass list in snort's settings has a list which points to a system-wide alias which contains 100+ FQDN entries and snort seems not to be able to use it saying:

FQDN aliases are not supported in Snort.

By being so, users are forced to maintain IP addresses or IP ranges in their already light-years long aliases, or worst, disable the triggering rules in snort, therefore mining the effectiveness of the snort application.

Actions
Copy link

Also available in: Atom PDF