[Snort-devel] Problems with distance attribute in 1.9

Chris Green cmg at ...402...
Mon Aug 19 07:00:03 EDT 2002


Russell Fulton <r.fulton at ...1343...> writes:

> Below is a note I posted to the sigs list recently.  Now that I have
> found out what distance is supposed to do I now assert that it isn't
> working properly in build 184.  
>
> Please reply direct to me as I am not on the developers list.
>
> Russell
>
> Hi,
>  I am running snort 1.9.0beta2 (Build 184) and I am getting lots of
> false positives on some new rules.  I an not sure if this is a problem
> with the rules or a problem with snort.  I notice this rule use
> 'distance' which I can't find in the documentation, persumably
> another new feature in 1.9.

Yes, but it doesn't work yet.  These rules should be disabled by
default in experimental.rules and this is a feature that doesn't have
to work to get 1.9 out the door.

It will hopefully work by 1.9.1 and if it does, it will then appear in
the documentation.
-- 
Chris Green <cmg at ...402...>
Fame may be fleeting but obscurity is forever.




More information about the Snort-devel mailing list