Snort mailing list archives
RE: problem with snort documentation: reference keyword url explanation wrong?
From: "Lee Clemens" <snort () leeclemens net>
Date: Fri, 11 Mar 2005 19:49:16 -0500
I'm confused as to why you think it suggests writing it this way "reference:url,http://www.somesite.com". The table shows URL prefixes that are added via the specific reference codes (bugtraq, cve, etc...). It shows "url" as adding the prefix "http://", so that you would write "url," instead of "http://" That page does, however, provide an (outdated) incorrect link to "http://www.snort.org/snort-db/" which no longer seems to work... -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of James Affeld Sent: Friday, March 11, 2005 7:06 PM To: snort-users () lists sourceforge net Subject: [Snort-users] problem with snort documentation: reference keyword url explanation wrong? In rules that work, url references without special treatment that sites like bugtraq & arachnids get are handled this way: reference:url,www.somesite.com the documentation 3.4.2 at: http://www.snort.org/docs/snort_htmanuals/htmanual_231/node20.html#SECTION00 442100000000000000 suggests that you should it this way: reference:url,http://www.somesite.com snort rules parsing then seems to barf on the unexpected : __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/ ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- problem with snort documentation: reference keyword url explanation wrong? James Affeld (Mar 11)
- RE: problem with snort documentation: reference keyword url explanation wrong? Lee Clemens (Mar 11)