[Snort-sigs] Beginner Rule Problem

wkitty42 at ...3507... wkitty42 at ...3507...
Thu Oct 10 21:56:03 EDT 2013


On Thursday, October 10, 2013 2:08 PM, Kodiak80 <kodiak80 at ...2420...> wrote: 
> I finally got my issue resolved with help over on the pfSense forums.  In case 
> anyone else runs into a similar problem, I was missing a classification in my 
> rule.  Once I added a 'classtype: inappropriate-content', the rule worked as 
> expected.  Not sure if that is a general Snort requirement, or unique to the 
> pfSense Snort install.  Thanks to those offering help. 

snort does not complain about basic rules that do not include such things as SID, MSG and apparently classtype... there may be others...

NOTE to snort development team: please cause snort to error on rules that do not conform to basics and report exactly why the rule is being complained about... :)






More information about the Snort-sigs mailing list