My last email today, really!

Wozz wozz+argus at wookie.net
Wed Nov 14 15:48:17 EST 2001


On Wed, Nov 14, 2001 at 03:33:08PM -0500, Carter Bullard wrote:
> Doesn't the example fmodel.conf file have
> an "echo" in the src ports field of a Flow model
> definition?
> 
> All echo's whether they are echo requests or
> reply should be mapped to echo in the aggregator
> or filter commands, at least that's what its
> suppose to do.
> 


Oops, my mistake.  I had the src and dst mixed up in the rule, so
it was filtering the echo's but not the echo replies.  Don't mind
me. 



More information about the argus mailing list