Snort mailing list archives
Re: Snort3: rule_state syntax
From: Russ via Snort-users <snort-users () lists snort org>
Date: Sat, 27 Oct 2018 07:38:59 -0400
This is now fixed: $ snort --help-config rule_state int rule_state[].gid = 0: rule generator ID { 0: } int rule_state[].sid = 0: rule signature ID { 0: } The format is a list: rule_state = { { gid = 1, sid = 123, enable = false }, { gid = 1, sid = 456, enable = true }, } On 10/24/18 4:56 PM, Russ via Snort-users wrote:
Oops - that appears to be broken. It should be a list like suppress. We'll get that fixed ASAP. Thanks for reporting the issue.Russ On 10/24/18 11:58 AM, Meridoff via Snort-users wrote:Hello , what is correct syntax for rule_state ?In manual it is not obvious : i can only disable one rule if I follow snort3 documentation.Is rule_state is table ? For example, rule_state = { {gid=1,sid=123, enable=false}, {}, ... }Thanks. _______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visithttp://blog.snort.org to stay current on all the latest Snort news! Please follow these rules:https://snort.org/faq/what-is-the-mailing-list-etiquette_______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: snort-users-leave () lists snort org Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- Snort3: rule_state syntax Meridoff via Snort-users (Oct 24)
- Re: Snort3: rule_state syntax Russ via Snort-users (Oct 24)
- Re: Snort3: rule_state syntax Russ via Snort-users (Oct 27)
- Re: Snort3: rule_state syntax Russ via Snort-users (Oct 24)