Snort mailing list archives
Re: Warning after rules update
From: Joel Esler <jesler () sourcefire com>
Date: Wed, 11 Sep 2013 09:45:54 -0400
On Sep 11, 2013, at 7:11 AM, Y M <snort () outlook com> wrote:
After running an update to the latest rules tarball (2.9.5.3), I get the following warning: "WARNING: /path/to/snort.rules(8912) at most one HTTP buffer may be indicated with pcre" Line 8912 points to sid:6343. I am using PulledPork v0.7.0 to generate the rules. Any ideas why?
Yes. The pcre read “HsmiH”. I fixed it. It’ll be in the next rule release.
------------------------------------------------------------------------------ How ServiceNow helps IT people transform IT departments: 1. Consolidate legacy IT systems to a single system of record for IT 2. Standardize and globalize service processes across IT 3. Implement zero-touch automation to replace manual, redundant tasks http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Warning after rules update Y M (Sep 11)
- Re: Warning after rules update Joel Esler (Sep 11)
- Re: Warning after rules update Y M (Sep 11)
- Re: Warning after rules update Joel Esler (Sep 11)