[Snort-users] Rules from Snort don't match Arachnids?

Brian Caswell bmc at ...312...
Wed Apr 25 23:35:32 EDT 2001


Max Vision wrote:
> 
> On Wed, 25 Apr 2001 rottz at ...1904... wrote:
> > I would also like to take this time to ask if we can correct
> > "reference:arachnids,#;"
> > Because sp_reference.h line 32 points to
> > "http://www.whitehats.com/info/" which should be
> > "http://www.whitehats.com/info/IDS" or we will have to change the
> > reference tags to "reference:arachnids,IDS#;" Either will work but I
> > prefer to change sp_reference.h so we can cut down the space in the
> > rules file, because they are getting pretty BIG now a days.
> >
> 
> Good point, my reference numbers include IDS, so I should preserve this in
> the reference link.  I'm sorry that I sort of contradict what you are
> saying here, but I believe that these references should be to "IDS###" and
> not just the number.
> 
> I will update the database to show all reference tags as:
> reference:arachnids,IDS###;
> asap.

Nope nope, don't do that just yet.  (hopefully you get this in
time...)

I've just changed CURRENT to support the url
www.whitehats.com/info/IDS

Since both snort.org and arachNIDS use just the numbers, this change
is MUCH easier.

-brian




More information about the Snort-users mailing list