Snort mailing list archives
Rule Actions's Name lenght problem
From: Mohamed LRHAZI <mohamed () lrhazi com>
Date: Wed, 4 Jul 2001 13:47:22 -0400
Hi all, Maybe I am programing snort the wrong way... but I did stumble on a little problem: Using snort 1.7, Only the first three chars of the rule action name is significant! and is actually seen by Snort! Is this known issue ? Example: # cat toto.conf var badguy 1.2.3.4 ruletype log1 { type log output log_tcpdump: log1.dump } ruletype log2 { type log output log_tcpdump: log2.dump } log1 tcp any any -> $badguy 21 (msg:"FTP Username"; content:"USER ";nocase; flags:A+;) log2 tcp any any -> $badguy 21 (msg:"FTP Password"; content:"PASS ";nocase; flags:A+;) # snort -c toto.conf -l log -d -r capture.dump Initializing rule chains... ERROR line toto (3): Duplicate keyword: log1 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Rule Actions's Name lenght problem Mohamed LRHAZI (Jul 04)