Snort mailing list archives
help writing snort rule
From: "Bill Lopez" <Bill () oefi org>
Date: Thu, 25 Jan 2007 22:56:24 -0800
Trying to write a simple rule to parse for SSN in plain text - what am I doing wrong?? alert ip any any -> $EXTERNAL_NET any (pcre:"/\d{3}(\s|-)?\d{2}(\s|-)?\d{4}/"; msg:"SSN Detected in Clear Text"; sid: 1000004 ) rule returns this error ERROR: Unterminated rule in file /etc/snort/rules/TEST.rules, line 5 (Snort rules must be contained on a single line or on multiple lines with a '\' continuation character at the end of the line, make sure there are no carriage returns before the end of this line) Fatal Error, Quitting.. Have tried multiple versions of pcre string but always return the same error.. Bill Lopez Operating Engineers Trust Funds (626) 356-3524 (626) 255-1066
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- help writing snort rule Bill Lopez (Jan 25)
- Re: help writing snort rule Nerijus Krukauskas (Jan 25)
- Re: help writing snort rule Matt Jonkman (Jan 26)
- Re: help writing snort rule Joel Esler (Jan 26)
- <Possible follow-ups>
- Re: help writing snort rule Bill Lopez (Jan 26)
- Re: help writing snort rule Joel Esler (Jan 26)
- Re: help writing snort rule Blake Hartstein (Jan 26)
- Re: help writing snort rule Bill Lopez (Jan 26)