[Snort-users] Rules from Snort don't match Arachnids?

rottz at ...1904... rottz at ...1904...
Wed Apr 25 22:36:49 EDT 2001


But wouldn't it be easier just to add the "IDS" into sp_reference.h
because it NEVER changes. Unless you are not always going to use
"IDS###" ? Because if its NOT going to change, I think it should be
included in the header so we can reduce rule file size(which is growing
rapidly!)
Cause it would save us 3 characters PER rule times 500 rules is 1500
characters saved!
But its upto you, I know you got alot of new features coming out soon
and you have the bigger "Vision" of what you want ArachNIDS to be and
how you want it to work. 
Its already the best IDS db on the net, can't wait to see what you got
in store for us next! :)

Rottz

>Max Vision wrote:
> 
> On Wed, 25 Apr 2001 rottz at ...1904... wrote:
> > I would also like to take this time to ask if we can correct
> > "reference:arachnids,#;"
> > Because sp_reference.h line 32 points to
> > "http://www.whitehats.com/info/" which should be
> > "http://www.whitehats.com/info/IDS" or we will have to change the
> > reference tags to "reference:arachnids,IDS#;" Either will work but I
> > prefer to change sp_reference.h so we can cut down the space in the
> > rules file, because they are getting pretty BIG now a days.
> >
> 
> Good point, my reference numbers include IDS, so I should preserve this in
> the reference link.  I'm sorry that I sort of contradict what you are
> saying here, but I believe that these references should be to "IDS###" and
> not just the number.
> 
> I will update the database to show all reference tags as:
> reference:arachnids,IDS###;
> asap.
> 
> Thanks for brining this to light.
> 
> Max




More information about the Snort-users mailing list