[Snort-devel] [PATCH]: Fix Snort references parsing

Yoann Vandoorselaere yoann.v at ...2801...
Fri Feb 17 04:57:08 EST 2006


On Thu, 2006-02-16 at 17:41 -0500, Matthew Watchinski wrote:
> Just an FYI, the VRT rule merge and build system strips spaces after 
> "x:" by default, as this problem has occured with other keywords.  You 
> shouldn't ever see this issue in any of the VRT Certified rule packages.

Yes, the 'reference: ' issue was seen with bleeding snort rulesets. I'd
still suggest, however, that the spaces be stripped (as it is done for
some others Snort keywords), for sanity.

Regards,

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com





More information about the Snort-devel mailing list