Snort mailing list archives
Re: Whitehats rules don't work
From: François Désarménien <francois () fdesar net>
Date: Tue, 5 Jun 2001 09:25:43 +0200
Mon, 4 Jun 2001 15:48:21 +0530 "Sid" <s_i_d_j () yahoo com> wrote:
Hi, I know i've missed something but the vision18.conf i downloaded from whitehats.com doesn't work. It gives a lot of errors while starting snort about bad rules. I think its the classification. Anyway, whats the way out??
Yes, you're right : there's a problem with rule #436 which is classified as 'relay-or-info-attempt' that doesn't exist in the classification rules. Either change its tag, add new classification or comment out the rule to have it load. First option seems to me to be the best. Having done that, it works perfectly for me with 1.8beta4. François _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Whitehats rules don't work Sid (Jun 04)
- Re: Whitehats rules don't work Chris Green (Jun 04)
- Re: Whitehats rules don't work Max Vision (Jun 04)
- Re: Whitehats rules don't work François Désarménien (Jun 05)
- Whitehats rules work :) (was Re: Whitehats rules don't work) Max Vision (Jun 05)
- Re: Whitehats rules work :) (was Re: Whitehats rules don't work) Max Vision (Jun 05)
- Whitehats rules work :) (was Re: Whitehats rules don't work) Max Vision (Jun 05)
- <Possible follow-ups>
- RE: Whitehats rules don't work Ginnetty, James (Jun 04)
- RE: Whitehats rules don't work Caruso, Ken (Jun 04)
- Fw: Whitehats rules don't work Sid (Jun 04)
- Re: Fw: Whitehats rules don't work Phil Wood (Jun 05)