[Snort-devel] Problems with distance attribute in 1.9

Chris Green cmg at ...402...
Mon Aug 19 07:00:03 EDT 2002

Russell Fulton <r.fulton at ...1343...> writes:

> Below is a note I posted to the sigs list recently.  Now that I have
> found out what distance is supposed to do I now assert that it isn't
> working properly in build 184.  
> Please reply direct to me as I am not on the developers list.
> Russell
> Hi,
>  I am running snort 1.9.0beta2 (Build 184) and I am getting lots of
> false positives on some new rules.  I an not sure if this is a problem
> with the rules or a problem with snort.  I notice this rule use
> 'distance' which I can't find in the documentation, persumably
> another new feature in 1.9.

Yes, but it doesn't work yet.  These rules should be disabled by
default in experimental.rules and this is a feature that doesn't have
to work to get 1.9 out the door.

It will hopefully work by 1.9.1 and if it does, it will then appear in
the documentation.
Chris Green <cmg at ...402...>
Fame may be fleeting but obscurity is forever.

More information about the Snort-devel mailing list