Next: Active Response
Up: Multiple Configurations
Previous: Events and Output
Snort assigns every incoming packet to a unique configuration based on the following criteria.
If VLANID is present, then the innermost VLANID is used to find bound configuration. If the
bound configuration is the default configuration, then destination IP address is searched to
the most specific subnet that is bound to a non-default configuration. The packet is assigned
non-default configuration if found otherwise the check is repeated using source IP address.
In the end, default configuration is used if no other matching configuration is found.
For addressed based configuration binding, this can lead to conflicts between configurations
if source address is bound to one configuration and destination address is bound to another.
In this case, snort will use the first configuration in the order of definition, that can be
applied to the packet.