Re: New netbios rules?

[Joel Esler <jesler () sourcefire com>]

On Jun 16, 2009, at 10:17 AM, jlay () slave-tothe-box net wrote:

> After updating this morning I see:
>
> Jun 16 08:12:25 10.21.10.2 snort[7899]: FATAL ERROR: Warning:
> /usr/local/etc/snort/rules/netbios.rules(24) => Unknown keyword '
> dce_iface' in rule!
>
> Version is:
>
> Version 2.8.4.1 (Build 38)
>
> Do I need to update snort?  Thanks.

No, but you do need to enable the dce/rpc2 preprocesor in your  
snort.conf


--
joel esler | Sourcefire | gtalk: jesler () sourcefire com | 302-223-5974
[m]

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing 
server and web deployment.
http://p.sf.net/sfu/businessobjects

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users