[Snort-users] unknown keyword in vision.rules

Max Vision vision at ...4...
Sat Apr 21 08:07:12 EDT 2001


This is supported in Snort 1.8 - which you can download (BETA 3) at
whitehats.com, or directly from the CVS server at Sourceforge:
http://snort.sourceforge.net/snort-daily.tar.gz

If it is not feasible for you to upgrade, you can do this for Snort 1.7:

   cat vision.conf | sed 's/uricontent/content/g' > vision.conf

Max

On Sat, 21 Apr 2001, dotslash wrote:
>
> i d/l snort-1.7 today and also vision.rules.  when i ran snort using
> vision.rules i get the following:
>
> Apr 21 15:03:36 snortle snort:  ERROR: vision.rules (93) => Unknown keyword
> "uricontent" in rule!
>
> i was using vision.rules with snort-1.7 before and never encountered this
> before.  what must be done with this?
>





More information about the Snort-users mailing list