[Snort-sigs] [Fwd: Proposed change to the Virus Rule]

Matthew Jonkman matt at ...2436...
Wed Jul 7 09:05:01 EDT 2004

Brian wrote:
> One of the many things Sourcefire has brought to Snort is QA.  I built
> a regression test suite for the Snort ruleset that must have no
> failures for us to "ship" new rules.  Currently, I am running over
> 2,500,000 separate unit tests, any failure requires fixing the
> failure, and restarting the test.

Interesting. If you have time somewhere down the road we'd appreciate 
hearing more about the test suite. Would that be something that you 
could make public one day? (I understand if not, you are on the clock 
there writing it)

>>On the post I made last week (below) I'm more concerned that there's a 
>>pcre issue in snort. Several people have responded off list and we've 
>>not got an answer yet. Should I shoot this over to snort-devel?
> I have not got to that one yet.  It requires more thinking than "Yep"
> or "nope" but it is in my queue.  Be patient :)

Thanks. Now that I know what's going on behind the scenes we'll not be 
so antsy to get new updates. :)


More information about the Snort-sigs mailing list