Snort mailing list archives
Re: disabled flowbits?
From: JJ Cummings <cummingsj () gmail com>
Date: Thu, 26 Aug 2010 10:39:55 -0600
Pulledpork checks these dependencies for you when you use it to manage your ruleset. Sent from the iRoad On Aug 26, 2010, at 10:31, Russ Combs <rcombs () sourcefire com> wrote:
On Thu, Aug 19, 2010 at 1:44 PM, waldo kitty <wkitty42 () windstream net> wrote: can someone please explain why these broken SIDs are not also disabled when the required flowbit setting SID is disabled?? Unfortunately, Snort doesn't automatically disable such rules, but the warnings are there to help you fix the problem as you see fit. We do have a bug on this, but it is low priority. VRT can address the specific cases in question. Russ WARNING: SID 13865 depends on flowbit "http.bmp" which is set in INACTIVE SID 16205 (SID 13865 is broken unless you also enable SID 16205). WARNING: SID 13712 depends on flowbit "tlsv1.client_hello.request" which is set in INACTIVE SID 3059 (SID 13712 is broken unless you also enable SID 3059). WARNING: SID 13711 depends on flowbit "tlsv1.client_hello.request" which is set in INACTIVE SID 3059 (SID 13711 is broken unless you also enable SID 3059). WARNING: SID 13714 depends on flowbit "tlsv1.client_hello.request" which is set in INACTIVE SID 3059 (SID 13714 is broken unless you also enable SID 3059). WARNING: SID 13710 depends on flowbit "tlsv1.client_hello.request" which is set in INACTIVE SID 3059 (SID 13710 is broken unless you also enable SID 3059). WARNING: SID 13585 depends on flowbit "csv.download" which is set in INACTIVE SID 13584 (SID 13585 is broken unless you also enable SID 13584). WARNING: SID 13713 depends on flowbit "tlsv1.client_hello.request" which is set in INACTIVE SID 3059 (SID 13713 is broken unless you also enable SID 3059). ------------------------------------------------------------------------------ This SF.net email is sponsored by Make an app they can't live without Enter the BlackBerry Developer Challenge http://p.sf.net/sfu/RIM-dev2dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------------------------------ Sell apps to millions through the Intel(R) Atom(Tm) Developer Program Be part of this innovative community and reach millions of netbook users worldwide. Take advantage of special opportunities to increase revenue and speed time-to-market. Join now, and jumpstart your future. http://p.sf.net/sfu/intel-atom-d2d _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------ Sell apps to millions through the Intel(R) Atom(Tm) Developer Program Be part of this innovative community and reach millions of netbook users worldwide. Take advantage of special opportunities to increase revenue and speed time-to-market. Join now, and jumpstart your future. http://p.sf.net/sfu/intel-atom-d2d
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- disabled flowbits? waldo kitty (Aug 19)
- Re: disabled flowbits? Russ Combs (Aug 26)
- Re: disabled flowbits? JJ Cummings (Aug 26)
- Re: disabled flowbits? waldo kitty (Aug 26)
- Re: disabled flowbits? waldo kitty (Aug 26)
- Re: disabled flowbits? JJ Cummings (Aug 26)
- Re: disabled flowbits? Russ Combs (Aug 26)