I wish to get all the snort rules pertaining to attacks involving http, ftp, ssh, telnet etc. Is there a way to segregate the snort rules like this?
I want to create a distributed IDS/IPS using this approach. I am also open to suggestions which say this is a bad idea and I shouldn't do this.
