[Snort-devel] Snort Version 2.0.0 (Build 72) and up & portscan2-ignorehosts

Erek Adams erek at ...835...
Tue Jul 15 12:22:15 EDT 2003


On Mon, 14 Jul 2003, Sean Wheeler wrote:

> I noticed the following in when using \ in defining a long list of ip
> addresses.
> However the notation works fine with rules, but does not work with the
> portscan2-ignorehosts directive

[...snip...]

Yep.  Different parsers.

Fix?  Either patch the portscan(2) parser to accept it, or just have it
all on one line.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson




More information about the Snort-devel mailing list