RE: Rules for Snort 2.6 RC1

[Frank Knobbe <frank () knobbe us>]

On Thu, 2006-04-27 at 11:10 -0400, Miner, Jonathan W (CSC) (US SSA)
wrote:
> Yes, I do... but that particular rule does not depend on SMTP_SERVERS.
> I should clarify that the crash occures when the rule is triggered,
> not when it is parsed.

Argh... sorry, read the wrong line. Indeed no SMTP_SERVER
there. ...hm...

> alert tcp !$HOME_NET any -> $HOME_NET 25 (msg: "BLEEDING-EDGE POLICY
> Inbound Frequent Emails -- Possible Spambot Inbound"; flags: S,12;
> threshold: type threshold, track by_src,count 10, seconds 60;
> classtype: misc-activity; sid: 2002087; rev:4;)

One thing you might want to check/try is to remove the signature related
info from the signature, sig_reference, and reference tables. It could
be that it barfs on creation of the rule when it already exists (missing
check on an error condition during SQL handling).

Syntactically the rules appears to look clean.

ooh...ooh... Remove the "--". Perhaps that confuses the DB.

Regards,
Frank

-- 
It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

Attachment: signature.asc
Description: This is a digitally signed message part