Re: Why all the rules parsing errors?

[Dragos Ruiu <dr () kyx net>]

Hunch:

You did the make and then you didn't do the make install
and the old snort is earlier in your path than ./snort....
(Not that I would ever make such a silly mistake, nope... 
 Just a hunch... ;-)

cheers,
--dr


On Sat, 04 Aug 2001, Andrew R. Baker wrote:
> It sounds like you are somehow still running the old version of snort. 
> What version is it reporting when it starts up?
>
> -Andrew
>
> --- Don Heffernan <donheff () cais net> wrote:
> > I just upgraded from snort 1.3 or something to 1.8p1. I then downloaded
> > the latest ruleset I saw posted (1.7). I had to edit snort.conf to get
> > lots of spaces out and finally got it working, but when it gets to the
> > rules include files I am getting errors that would indicate that most of
> > the rules are invalid.
> >
> > The first error (line 4 in exploits) is "bad TCP flag = "+". The
> > relevant portion of the line reads: "...; flags: A+; content:..." The
> > problem is there are countless lines that use this same construction -
> > are they all wrong?
> >
> >  I commented out the first 7 lines in exploits (passing by the first
> > bunch of A+ lines) and then got an error in line 8: "Unknown Keyword
> > "reference" in rule! Once again, the error is present in countless
> > lines. The relevant section of line 8 is: "...; reference:
> > arachnids,492;)"
> >
> > Can anyone help me out here? If you hadn't already guessed I am not
> > familiar with the proper syntax.
> >
> > --
> > Don Heffernan
> > heffernan.cais.net
> >
> >
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > http://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> __________________________________________________
> Do You Yahoo!?
> Make international calls for as low as $.04/minute with Yahoo! Messenger
> http://phonecard.yahoo.com/
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- 
Dragos Ruiu <dr () dursec com>   dursec.com ltd. / kyx.net - we're from the future 
gpg/pgp key on file at wwwkeys.pgp.net or at http://dursec.com/drkey.asc

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users