Re: ignore bad rule on startup

[Matthew Watchinski <mwatchinski () sourcefire com>]

There is currently no way to do what your asking.  The reason for this 
is snort parses the rules keyword by keyword.  It doesn't parse the 
rule, validate the rule, and then load the rule into the opt tree node.

Cheers,
-matt

kakomon wrote:
> yes i understand this, however, what if a new 'bad' rule with a new sid
> would be committed ?
>
> thank you all
> .mike
>
>
>
> On Wed, 2006-07-19 at 17:57 +0200, Klein, Jeremie wrote:
>
> > Hi,
> >
> > Oinkmaster can modify the rules on the fly just after downloading.
> > You have to configure him as explained in the example. It is based on Sids, so you just can tell to oinkmaster to 
> > comment out your rule given a sid.
> >
> > -----Message d'origine-----
> > De : snort-users-bounces () lists sourceforge net [mailto:snort-users-bounces () lists sourceforge net] De la part de 
> > kakomon
> > Envoyé : mercredi 19 juillet 2006 23:52
> > À : snort-users () lists sourceforge net
> > Objet : Re: [Snort-users] ignore bad rule on startup
> >
> > Thank you for your answer Paul
> > however i'm asking if there is an option, an argument, a switch or
> > something, to make snort skip eventual garbage during startup
> >
> > i've seen snort refusing to start due a 'fwsam' directive in some
> > bleedingedge rules, like the file 'bleeding-dshield-BLOCK.rules'
> >
> > or, for example, if it finds two rules with the same SID
> >
> > i'll like to know if the behaviour could be to simply skip those rules
> >
> > this would provide me to auto-download the rules,
> > maybe with oinkmaster
> >
> > now it's not possible because if a new rules update could breaks snort,
> > it will not startup anymore
> >
> > think about the disaster if snort is inline:
> > all the traffic would be waiting in queue !
> >
> > thank you very much for your time
> > .mike
> >
> >
> > On Wed, 2006-07-19 at 10:21 -0500, Paul Schmehl wrote:
> >
> > > kakomon wrote:
> > >
> > > > Hi all !
> > > > i've just subscribed this list and here comes the first question:
> > > > is there a way to make snort ignore a bad rule on startup, instead of
> > > > throwing an error and don't start at all ?
> > >
> > > Sure.  Just comment the rule out.
> >
> >
> > -------------------------------------------------------------------------
> > Take Surveys. Earn Cash. Influence the Future of IT
> > Join SourceForge.net's Techsay panel and you'll get the chance to share your
> > opinions on IT & business topics through brief surveys -- and earn cash
> > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
> > -------------------------------------------------------------------------
> > Take Surveys. Earn Cash. Influence the Future of IT
> > Join SourceForge.net's Techsay panel and you'll get the chance to share your
> > opinions on IT & business topics through brief surveys -- and earn cash
> > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys -- and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users