[Snort-devel] rules problem relating to offset?

Kreimendahl, Chad J Chad.Kreimendahl at ...1167...
Mon Mar 31 13:13:01 EST 2003


With the most recent build of snort.

FATAL ERROR: snort.conf (858): Unable to parse as offset value string

and... line 858 is:

alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"IMAP list overflow
attempt"; flow:established,to_server; content:" LIST |22 22| {
"; nocase; byte_test:5,>,256,string,dec,relative;
reference:nessus,10374; reference:cve,CAN-2000-0284;
classtype:misc-attack; sid:18
45; rev:6;)






More information about the Snort-devel mailing list