[Snort-users] Rules from Snort don't match Arachnids?

Brian Caswell bmc at ...312...
Wed Apr 25 23:35:32 EDT 2001

Max Vision wrote:
> On Wed, 25 Apr 2001 rottz at ...1904... wrote:
> > I would also like to take this time to ask if we can correct
> > "reference:arachnids,#;"
> > Because sp_reference.h line 32 points to
> > "http://www.whitehats.com/info/" which should be
> > "http://www.whitehats.com/info/IDS" or we will have to change the
> > reference tags to "reference:arachnids,IDS#;" Either will work but I
> > prefer to change sp_reference.h so we can cut down the space in the
> > rules file, because they are getting pretty BIG now a days.
> >
> Good point, my reference numbers include IDS, so I should preserve this in
> the reference link.  I'm sorry that I sort of contradict what you are
> saying here, but I believe that these references should be to "IDS###" and
> not just the number.
> I will update the database to show all reference tags as:
> reference:arachnids,IDS###;
> asap.

Nope nope, don't do that just yet.  (hopefully you get this in

I've just changed CURRENT to support the url

Since both snort.org and arachNIDS use just the numbers, this change
is MUCH easier.


More information about the Snort-users mailing list