Re: Snort3: rule_state syntax

[Russ via Snort-users <snort-users () lists snort org>]

This is now fixed:

$ snort --help-config rule_state
int rule_state[].gid = 0: rule generator ID { 0: }
int rule_state[].sid = 0: rule signature ID { 0: }

The format is a list:

rule_state =
{
    { gid = 1, sid = 123, enable = false },
    { gid = 1, sid = 456, enable = true },
}

On 10/24/18 4:56 PM, Russ via Snort-users wrote:
> Oops - that appears to be broken.  It should be a list like suppress.  
> We'll get that fixed ASAP.  Thanks for reporting the issue.
>
> Russ
>
> On 10/24/18 11:58 AM, Meridoff via Snort-users wrote:
> > Hello , what is correct syntax for rule_state ?
> > In manual it is not obvious : i can only disable one rule if I follow 
> > snort3 documentation.
> >
> > Is rule_state is table ? For example, rule_state = { {gid=1,sid=123, 
> > enable=false}, {}, ... }
> >
> > Thanks.
> >
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists snort org
> > Go to this URL to change user options or unsubscribe:
> > https://lists.snort.org/mailman/listinfo/snort-users
> >
> >         To unsubscribe, send an email to:
> >         snort-users-leave () lists snort org
> >
> > Please visithttp://blog.snort.org  to stay current on all the latest Snort news!
> >
> > Please follow these rules:https://snort.org/faq/what-is-the-mailing-list-etiquette
>
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists snort org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
>         To unsubscribe, send an email to:
>         snort-users-leave () lists snort org
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
>
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette