RE: Unknown keyword ' ftpbounce' in rule

["Pachulski, Keith" <kpachulski () corp ptd net>]

http://www.snort.org/pub-bin/downloads.cgi

"Snort 2.3.1 or higher is required to run CURRENT and 2.3 Rule Snapshots."

-----Original Message-----
From: Matthew Watchinski [mailto:mwatchinski () sourcefire com]
Sent: Wednesday, April 06, 2005 3:10 PM
To: Snort-Users (E-mail)
Subject: Re: [Snort-users] Unknown keyword ' ftpbounce' in rule


If your running 2.3.2 you should download the 2.3 snapshot.  Currently 
CURRENT tracks HEAD/2.4.  The ftpbounce keyword is in 2.4 and HEAD.

Cheers,
Matthew Watchinski
Director, Vulnerability Research
Sourcefire, Inc.

Robert Bilbrey wrote:

> Had to comment it out, it is in the vrt ruleset, but snort doesn't 
> recognize it.
>
> Pachulski, Keith wrote:
>
> > Is anyone else getting this or just me? I searched for the ftpbounce 
> > keyword in the 2.3.2 user manual and found nothing..
> >
> > ERROR: Warning: /home/snort/sigs/ftp.rules(119) => Unknown keyword ' 
> > ftpbounce' in rule!
> > Fatal Error, Quitting..
> >
> > [root@nids snort-2.3.2]# snort -V
> >
> >    ,,_     -*> Snort! <*-
> >   o"  )~   Version 2.3.2 (Build 12)
> >    ''''    By Martin Roesch & The Snort Team: 
> > http://www.snort.org/team.html
> >            (C) Copyright 1998-2004 Sourcefire Inc., et al.
> >
> > |Keith A. Pachulski | PenTeleData LP1 Corporate Security Coordinator |
> > |Phone: (800) 281.3564 x2454 | Pager: 6103497095 () vtext com|
> > |PGP: 6B56 C8DC 6201 6D1A BFF5  5799 E193 ABAA 9549 74D0|
> >
> >
> > -------------------------------------------------------
> > SF email is sponsored by - The IT Product Guide
> > Read honest & candid reviews on hundreds of IT Products from real users.
> > Discover which products truly live up to the hype. Start reading now.
> > http://ads.osdn.com/?ad_ide95&alloc_id396&op=click
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=ort-users
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_ide95&alloc_id396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users