[Snort-sigs] Lost message and classification

Dragos Ruiu dr at ...60...
Mon Jun 10 23:18:04 EDT 2002


On 11 Jun 2002 16:08:03 +1200
Russell Fulton <r.fulton at ...575...> wrote:
> Hmmmm... I may look at the source and tweak it so that this particular
> problem raises an error to protect idiots like me from ourselves!
> I'll pass the patches back of course.

A while back I built a snort rules parser that mixed postfix and prefix
parsing to make more intelligent guesses at mangled rules and give better
diagnostics as well as being more buletproof.  It was in the snortpp
pre-processor in the contrib directory on old releases...

cheers,
--dr

-- 
--dr                  pgpkey: http://dragos.com/dr-dursec.asc
        0 = 1 , for large values of zero and small values of one.




More information about the Snort-sigs mailing list