Re: Pulledpork doesn't disable some rules

["C. L. Martinez" <carlopmart () gmail com>]

On Mon, Apr 14, 2014 at 6:22 AM, Y M <snort () outlook com> wrote:
> This is probably because of the existence of a flowbit in the rule. You
> disable it, however, PulledPork checks/verifies flowbits, and will re-enable
> rules based on that. Can you run your PulledPork command with -v to output
> in verbose mode? If there is a flowbit conflict with your rule disablement,
> it will show up in PulledPork output.
>
> YM

Oops .. You are right YM:

Cleanup....
removed 55 temporary snort files or directories from /tmp/tha_rules!
Processing /data/config/etc/idpsuricata02/pulledpork/disablesid.conf....
Disabled 1:2009005
Disabled 1:2011582
Modified 2 rules
Done
Setting Flowbit State....
WARN - 1:2011582 is re-enabled by a check of the
ET.http.javaclient.vulnerable flowbit!
Enabled 39 flowbits
Done
Writing rules to unique destination files....
Writing rules to /data/config/etc/idpsuricata02/rules/
Done
Generating sid-msg.map....
Done
Writing v1 /data/config/etc/idpsuricata02/sid-msg.map....
Done
Fly Piggy Fly!

Uhmm .. How can I avoid this situation??

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/NeoTech
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!