[Snort-sigs] bug? in VRT rule classtype:misc-activity; sid:525; rev:10; ) flow:to_server

Nigel Houghton nhoughton at ...435...
Tue Apr 14 20:18:59 EDT 2009


On Tue, Apr 14, 2009 at 6:47 PM, Michael Scheidell <scheidell at ...249...> wrote:
> Apr 14 18:21:59 scanner snort[57515]: FATAL ERROR:
> rules/bad-traffic.rules(28): Cannot check flow connection for non-TCP
> traffic
>
> what am I missing?  there are lots of udp rules that have a flow.*
> signature.

Stream5?

README.stream5 says:

"track_udp <yes|no>      - Track sessions for UDP.  The default is "yes"."

Also, you should really upgrade to 2.8.4 :)

--
Nigel Houghton
Head Mentalist
SF VRT
http://vrt-sourcefire.blogspot.com && http://www.snort.org/vrt/




More information about the Snort-sigs mailing list