[Snort-sigs] Rule oddities in 1.8.1
cmg at ...26...
Tue Aug 21 14:38:22 EDT 2001
Mike Baptiste <mike at ...84...> writes:
> I came across some rule syntax errors in 1.8.1 - mostly minor and
> ignoreed by snort, but I figured I'd highlight them so they can be
> updated in the next ruleset...
> A number of rules have duplicate options, often for nocase, flags, and
> offset (my understanding from the docs is these are unique options) I
> quick check showed they were often set to the same thing anyway:
nocase,regex,offset,depth aren't unique. They are related to the
preceeding *content: option.
Flags is unique. I Think they are all fixed by Brian in current CVS
as of 10 minutes ago.
Chris Green <cmg at ...26...>
Laugh and the world laughs with you, snore and you sleep alone.
More information about the Snort-sigs