[Snort-devel] Version 1.8.7beta5 (Build 127) classification.config

Andrew R. Baker andrewb at ...402...
Wed Jun 26 06:30:07 EDT 2002


Phil Wood wrote:
> Why the patch below makes all the difference in the world, I don't know.
> There is something foobah with the parsing of the classification.config.
> If the patch is not in place, the mapping doesn't work, and you get
> 
> [Classification:  sig] inplace of
> [Classification: access to potentially vulnerable web application]
> 
> Too freaky for words.  Either there are some non-ascii characters buried
> somehwere in the rules or the classifiation.config, or some string lengths
> are whaco.  Ruined my day.  

What output plugins are you seeing this under?  I am trying to track it 
down.  Do you also see this under 1.9?  It has new implementation of the 
classification system.

 > See you in Boston?

I am not being sent to Boston. :(


-A





More information about the Snort-devel mailing list