snort-current rules syntax error

["Sean Wheeler" <S.Wheeler () netprotect ch>]

elo all,

lil typo on dns.rules :

alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named version
attempt"; content:"|07|version"; offset:12; content:"|04|bind"; nocase;
offset: 12; reference:arachnids,278; classtype:attempted-recon; sid:1616;
rev:1)

missing an ";" at the end there.

fix looks like :
alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named version
attempt"; content:"|07|version"; offset:12; content:"|04|bind"; nocase;
offset: 12; reference:arachnids,278; classtype:attempted-recon; sid:1616;
rev:1;)


 question concerning the above....is it or will it be possible for snort to
bypass failed rules and get on with the rest of the job while popping a "wtf
!!??" into your logs ?

regards

Sean





_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users