[Snort-sigs] Rules current -> 1.9

Brian bmc at ...95...
Fri Feb 7 09:44:29 EST 2003


On Thu, Feb 06, 2003 at 01:45:14PM -0600, Frank Knobbe wrote:
> - Removed byte_test rule option.
> - Removed byte_jump rule option.

nonononononono.  Please don't do this.  The rules with byte_test and
byte_jump are designed for byte_test and byte_jump specificly.  By
removing the options, you make the rules almost useless.  We "deleted" a
number of rules thanks to having byte_test and byte_jump.  The "deleted"
rules should be re-enabled for 1.9.

There is a reason I havn't been updating 1.9, because its a royal pain
in the ass.  Its great that you are tackling the problem, but there are
many issues that need to be delt with before your work will be merged.

-brian




More information about the Snort-sigs mailing list