[Snort-inline-users] Drop and rule order

[Jochen V. <jv...@it...>]

Hi,

I have the following problem.

If i set "etc/passwd" to drop i get an logging "etc/passwd"
If i set "etc/passwd" to alert i get an logging "http directory traversal"

I think this is an rule order problem?

Thx for help
jo