[Snort-devel] dirty submits to CVS?

Martin Roesch roesch at ...402...
Wed Jun 26 05:29:06 EDT 2002


2 points:

1) I just downloaded the snortrules.tar.gz file referenced in your link and
unpacked it.  Much to my surprise, I found that the rule that caused the
error in your message was commented out by default and contains options that
aren't available in the 1.8.x series of code.  The rule is turned off by
default for a reason, you must have enabled it causing the error.  Seems
like the responsibility for this issue lies less in the developers (who put
out a rules file that functions correctly) and more with yourself (who
modified a working file and made it non-working).

2) I just searched my entire Sourcefire email archive for mail from you and
ticm.com, all I found was list mail to snort-devel.  Were you sending from
some other address/name?  I don't see a single piece of mail from you ouside
snort-devel.  It should be noted that I am *not* the sales capability at
Sourcefire, I'm the Chief Technology Officer.  We have a dedicated direct
sales staff to handle inquiries about purchasing our systems.  Contact
sales at ...402... or call our toll-free number (check the web site) to
contact the appropriate people.

     -Marty


On 6/26/02 4:08 AM, "Bret Watson" <lists at ...1010...> wrote:

> Hi All,
> more crap turning up...
> 
> ok I'm running the 1.8.6 against
> http://www.snort.org/dl/signatures/snortrules.tar.gz
> 
> I get this error.. and I'm sure there are many more..
> 
> ERROR /opt/local/etc/./snort-rules/bad-traffic.rules(19) => Bad protocol
> name ">134"
> 
> So how come? apparently I'm running stable code? and stable rulesets? It
> really sucks when I get this type of sloppyness.. and since Martin never
> returns any emails to sourcefire.. I can't get a commercial system.. oh
> well should ring up the enterasys resellers..
> 
> Bret
> 
> 
> 
> 
> -------------------------------------------------------
> This sf.net email is sponsored by: Jabber Inc.
> Don't miss the IM event of the season | Special offer for OSDN members!
> JabConf 2002, Aug. 20-22, Keystone, CO http://www.jabberconf.com/osdn
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> 

-- 
Martin Roesch - Founder/CTO, Sourcefire Inc. - (410)290-1616
Sourcefire: Professional Snort Sensor and Management Console appliances
roesch at ...402... - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org





More information about the Snort-devel mailing list