[Snort-sigs] Rule oddities in 1.8.1

Chris Green cmg at ...26...
Tue Aug 21 14:38:22 EDT 2001


Mike Baptiste <mike at ...84...> writes:

> I came across some rule syntax errors in 1.8.1 - mostly minor and
> ignoreed by snort, but I figured I'd highlight them so they can be
> updated in the next ruleset...
> 
> 
> A number of rules have duplicate options, often for nocase, flags, and
> offset (my understanding from the docs is these are unique options)  I
> quick check showed they were often set to the same thing anyway:

nocase,regex,offset,depth aren't unique.  They are related to the
preceeding *content: option.

Flags is unique.  I Think they are all fixed by Brian in current CVS
as of 10 minutes ago.
-- 
Chris Green <cmg at ...26...>
Laugh and the world laughs with you, snore and you sleep alone.




More information about the Snort-sigs mailing list