[Snort-devel] Problems with distance attribute in 1.9
cmg at ...402...
Mon Aug 19 07:00:03 EDT 2002
Russell Fulton <r.fulton at ...1343...> writes:
> Below is a note I posted to the sigs list recently. Now that I have
> found out what distance is supposed to do I now assert that it isn't
> working properly in build 184.
> Please reply direct to me as I am not on the developers list.
> I am running snort 1.9.0beta2 (Build 184) and I am getting lots of
> false positives on some new rules. I an not sure if this is a problem
> with the rules or a problem with snort. I notice this rule use
> 'distance' which I can't find in the documentation, persumably
> another new feature in 1.9.
Yes, but it doesn't work yet. These rules should be disabled by
default in experimental.rules and this is a feature that doesn't have
to work to get 1.9 out the door.
It will hopefully work by 1.9.1 and if it does, it will then appear in
Chris Green <cmg at ...402...>
Fame may be fleeting but obscurity is forever.
More information about the Snort-devel