Snort mailing list archives
Win32 v2.13 build 27 problem
From: Rich Adamson <radamson () routers com>
Date: Fri, 4 Jun 2004 14:03:29 -0600
Think I've discovered a problem with the current Win32 build. Using the following rule: alert tcp $HOME)NET any -> any any (msg: "High traffic host, SYN packets"; flags:S; threshold: type both, track by_src, count 4000, seconds 60; classtype:misc-activity; sid: 1000002; rev:1;) Snort complains with: ERROR: *** threshold: count *** Invaalid integer input: 4000 Fatal Error, Quitting... If I swap "count 4000" with "seconds 60" (ordering only), the above error is reported for seconds instead of count. Looks like the code to interpret the integer that follows the parameter is not working correctly. A search of the recent archives does not indicate anyone else with the problem. Removing the above from the local.rules allows snort to operate correctly. Reading the README.Thresolding text file tends to suggest the above rule is constructed correctly. Is this a known problem or is this new? Rich ------------------------------------------------------- This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and evaluate today! http://www.installshield.com/Dev2Dev/0504 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Win32 v2.13 build 27 problem Rich Adamson (Jun 04)