Snort mailing list archives
Re: Current VRT keeps using threshold (in rule)?
From: Joel Esler <jesler () sourcefire com>
Date: Wed, 14 Apr 2010 18:21:01 -0400
They are supported, Snort is just giving you a warning, not an error. Thresholds still work. -- Sent from my iPad AIM: eslerjoel On Apr 14, 2010, at 5:28 PM, Javier Romero <javier () jacksecurity com> wrote:
Does anybody know why there still are non-supported signatures in the current VRT rules? My logs say this: Apr 14 02:35:03 sensor snort[6393]: Warning: /etc/snort/rules/policy.rules(68) => threshold (in rule) is deprecated; use detection_filter instead. ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs
------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs
Current thread:
- Current VRT keeps using threshold (in rule)? Javier Romero (Apr 14)
- Re: Current VRT keeps using threshold (in rule)? Joel Esler (Apr 14)
- Re: Current VRT keeps using threshold (in rule)? Patrick Mullen (Apr 15)