[Snort-users] Rules from Snort don't match Arachnids?

Max Vision vision at ...4...
Wed Apr 25 21:59:59 EDT 2001


On Wed, 25 Apr 2001 rottz at ...1904... wrote:
> I would also like to take this time to ask if we can correct
> "reference:arachnids,#;"
> Because sp_reference.h line 32 points to
> "http://www.whitehats.com/info/" which should be
> "http://www.whitehats.com/info/IDS" or we will have to change the
> reference tags to "reference:arachnids,IDS#;" Either will work but I
> prefer to change sp_reference.h so we can cut down the space in the
> rules file, because they are getting pretty BIG now a days.
>

Good point, my reference numbers include IDS, so I should preserve this in
the reference link.  I'm sorry that I sort of contradict what you are
saying here, but I believe that these references should be to "IDS###" and
not just the number.

I will update the database to show all reference tags as:
reference:arachnids,IDS###;
asap.

Thanks for brining this to light.

Max





More information about the Snort-users mailing list