[Snort-sigs] [Emerging-Sigs] Errors with the Snort manual

Joel Esler jesler at ...435...
Thu Feb 18 15:47:50 EST 2010

On Thu, Feb 18, 2010 at 3:43 PM, evilghost at ...3397... <
evilghost at ...3397...> wrote:

> Joel, can you also add these, as they were discovered in the Snort
> manual:
>    Escaping colon no longer necessary.
>    Disparity in spacing between the keyword and the argument, for
> example, page #126 example 3.5.7 or page #127 example 3.5.10 which
> includes both a space and a no-space after the keyword.  Actually, it
> looks like a good portion of the ABCDEF style matches are like this.
> The usage syntax clearly shows a space.  So which is the convention?  I
> know VRT says "no space" but the manual is all over the map with it's
> examples and usage syntax.
>    Page #120, 'kickass-porn' is still present, thought this was removed?
>    Page #120, example in section 3.4.7 has the semi-colon outside of
> the close parenthesis, this rule breaks Snort.
>    Page #117, hex content match, that's some insane spacing/format there.
>    Page #143, RPC example, has an extra semi-colon outside the close
> parenthesis.
> There may be more, I really hope this helps.  Thanks!
It does, and I'll create bugs for these.  Thanks.

Joel Esler
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20100218/6315fb76/attachment.html>

More information about the Snort-sigs mailing list