Snort mailing list archives
Re: Unknown keyword ' ftpbounce' in rule
From: Matthew Watchinski <mwatchinski () sourcefire com>
Date: Wed, 06 Apr 2005 15:21:33 -0400
Should read "Snort 2.4 or higher is required to run CURRENT" Thanks for pointing this out we'll get it updated shortly. Cheers, -matt Pachulski, Keith wrote:
http://www.snort.org/pub-bin/downloads.cgi "Snort 2.3.1 or higher is required to run CURRENT and 2.3 Rule Snapshots." -----Original Message----- From: Matthew Watchinski [mailto:mwatchinski () sourcefire com] Sent: Wednesday, April 06, 2005 3:10 PM To: Snort-Users (E-mail) Subject: Re: [Snort-users] Unknown keyword ' ftpbounce' in ruleIf your running 2.3.2 you should download the 2.3 snapshot. Currently CURRENT tracks HEAD/2.4. The ftpbounce keyword is in 2.4 and HEAD.Cheers, Matthew Watchinski Director, Vulnerability Research Sourcefire, Inc. Robert Bilbrey wrote:Had to comment it out, it is in the vrt ruleset, but snort doesn't recognize it.Pachulski, Keith wrote:Is anyone else getting this or just me? I searched for the ftpbounce keyword in the 2.3.2 user manual and found nothing..ERROR: Warning: /home/snort/sigs/ftp.rules(119) => Unknown keyword ' ftpbounce' in rule!Fatal Error, Quitting.. [root@nids snort-2.3.2]# snort -V ,,_ -*> Snort! <*- o" )~ Version 2.3.2 (Build 12)'''' By Martin Roesch & The Snort Team: http://www.snort.org/team.html(C) Copyright 1998-2004 Sourcefire Inc., et al. |Keith A. Pachulski | PenTeleData LP1 Corporate Security Coordinator | |Phone: (800) 281.3564 x2454 | Pager: 6103497095 () vtext com| |PGP: 6B56 C8DC 6201 6D1A BFF5 5799 E193 ABAA 9549 74D0| ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_ide95&alloc_id396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=ort-users------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_ide95&alloc_id396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=ort-users
------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Unknown keyword ' ftpbounce' in rule Pachulski, Keith (Apr 06)
- Re: Unknown keyword ' ftpbounce' in rule Robert Bilbrey (Apr 06)
- Re: Unknown keyword ' ftpbounce' in rule Matthew Watchinski (Apr 06)
- <Possible follow-ups>
- RE: Unknown keyword ' ftpbounce' in rule Pachulski, Keith (Apr 06)
- Re: Unknown keyword ' ftpbounce' in rule Matthew Watchinski (Apr 06)
- Re: Unknown keyword ' ftpbounce' in rule Jeremy Hewlett (Apr 06)
- Re: Unknown keyword ' ftpbounce' in rule Matthew Watchinski (Apr 06)
- Re: Unknown keyword ' ftpbounce' in rule Robert Bilbrey (Apr 06)