Snort mailing list archives
RE: Help w/ Bleeding Snort Rules on XP
From: "James Bruce" <jbruce () unitedscience com>
Date: Fri, 10 Jun 2005 09:30:27 -0500
Michael, thanks for the reply. WordPad is a lot easier then notepad. Wish WordPad had a line counter though. Anyway, I ended up having to go through the rules line by line (as Patrick mentioned..thanks) and commented out some lines. Everything works fine now. Now for sure what in the line wouldn't make it work. I've never wrote a rule..but learning. Here is an example. ERROR: D:\win-ids\Snort\rules\bleeding-virus.rules(304) => getservbyname() faile d on "any" Fatal Error, Quitting.. This is line 304 for MyDoom.AH in the rule. If I comment that out, snort doesn't give me any errors. alert tcp $HOME_NET !$HTTP_PORTS -> $EXTERNAL_NET 1639:1640 (msg:"BLEEDING-EDGE WORM MyDoom.AH Victim Accessing Infected Page"; classtype:trojan-activity; flow:established,to_server; content:"/index.htm"; nocase; reference:url,us.mcafee.com/virusInfo/default.asp?id=description&virus_k =129631; sid:2001428; rev:6;) Thanks again to everyone who replied for the help. -Jimmy -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Michael Steele Sent: Thursday, June 09, 2005 7:06 PM To: James Bruce; snort-users () lists sourceforge net Subject: RE: [Snort-users] Help w/ Bleeding Snort Rules on XP Ok, you might have a problem with using 'Notepad' try 'WordPad'. Not sure why you have to copy and paste. The rules should be available in an archive format. Don't modify any of the rules and see if the error comes back. If there is no error then try to modify with 'Notepad', and if the error comes back you have the culprit. Kindest regards, Michael... WINSNORT.com Management Team Member -- Pick up your FREE Windows or UNIX Snort installation guides mailto:support () winsnort com Website: http://www.winsnort.com Snort: Open Source Network IDS - http://www.snort.org ------------------------------------------------------- This SF.Net email is sponsored by: NEC IT Guy Games. How far can you shotput a projector? How fast can you ride your desk chair down the office luge track? If you want to score the big prize, get to know the little guy. Play to win an NEC 61" plasma display: http://www.necitguy.com/?r _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Help w/ Bleeding Snort Rules on XP James Bruce (Jun 09)
- RE: Help w/ Bleeding Snort Rules on XP Michael Steele (Jun 09)
- <Possible follow-ups>
- RE: Help w/ Bleeding Snort Rules on XP James Bruce (Jun 10)