Snort mailing list archives
Re: test a threshold rule, please?
From: Rich Adamson <radamson () routers com>
Date: Tue, 6 Jul 2004 15:48:02 -0600
From that either a bug exists in v2.2.0rc1 or in the Win32 version.
Anyone care to try the rule below to help isolate the issue? (Would prefer either a linux or win32 attempt using v2.2.0rc1.)
------------------------The rule caused no problems for me in Snort 2.1.3 on Slackware Linux. On Tue, 6 Jul 2004 08:41:00 -0600, Rich Adamson <radamson () routers com> wrote:Could someone test the following rule in either linux or win32, please? alert tcp $HOME_NET any -> any any (msg: "High SYN Traffic"; flags:S; threshold: type threshold, track by_src, seconds 60, count 1; classtype:misc-activity; sid: 1000002; rev:1;) I'm trying to determine whether the above might indicate be a bug in linux, win32, or syntax error on my part. If I try the above rule in win32 (v2.2.0rc1 build 28), snort will not start due to an integer error reading the rule. Inserting content:" "; offset:0; in the above allows snort to start. Any help/suggestions would be greatly appreciated. Off-list comments are fine if you'd like. Rich ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users---------------End of Original Message-----------------
---------------End of Original Message----------------- ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- test a threshold rule, please? Rich Adamson (Jul 06)
- Message not available
- Re: test a threshold rule, please? Syke (Jul 06)
- Message not available
- Message not available
- Message not available
- Re: test a threshold rule, please? Rich Adamson (Jul 06)
- Message not available
- Re: test a threshold rule, please? sekure (Aug 05)
- Re: test a threshold rule, please? Rich Adamson (Aug 05)
- Re: test a threshold rule, please? Chris Reid (Aug 05)
- Re: test a threshold rule, please? Rich Adamson (Aug 05)
- <Possible follow-ups>
- RE: test a threshold rule, please? Joshua Berry (Jul 06)
- RE: test a threshold rule, please? Rich Adamson (Jul 06)