[Snort-users] Re: Snort Error (Newbie Alert)

Martin Roesch roesch at ...421...
Wed Mar 7 00:40:37 EST 2001


Check out http://www.snort.org/snort_rules.html for rules format
information, you've got a syntax error on line 21 of the exploit.rules
file.

     -Marty

Bob Staaf wrote:
> 
> To all,
> 
>      Well, as always things aren't as simple as they seem.  Will have to dig
> further.  If anyone has any ideas on this I would appreciate it.
> 
> Thanks
> 
> Bob
> 
> ----- Original Message -----
> From: "Bob Staaf" <rstaaf at ...1457...>
> To: "Bob Staaf" <rstaaf at ...1457...>; <Snort-users at lists.sourceforge.net>
> Sent: Tuesday, March 06, 2001 12:23 PM
> Subject: [Snort-users] Re: Snort Error (Newbie Alert)
> 
> > To all,
> >
> >      I think I might have found the problem.  In that particular rule
> there
> > was no space between EXPLOIT and x86.  I edited the rule and will see if
> > that takes care of it.
> >
> > Thanks
> >
> > Bob
> >
> > ----- Original Message -----
> > From: "Bob Staaf" <rstaaf at ...1457...>
> > To: <Snort-users at lists.sourceforge.net>
> > Sent: Tuesday, March 06, 2001 12:18 PM
> > Subject: Snort Error (Newbie Alert)
> >
> >
> > > Hello all,
> > >
> > >      Have successfully got snort 1.7 running on my Red Hat 6.2 server
> and
> > am
> > > now trying to get the latest rules running.  I am getting the following
> > > error when my server starts up snortd.  Any ideas?
> > >
> > > Mar  6 11:44:45 swshost snort: [!] ERROR
> > /etc/snort/rules/exploit.rules(21)
> > > => Bad port number: "(msg:"EXPLOIT"
> > >
> > > Thanks
> > >
> > > Bob
> > >
> >
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > http://lists.sourceforge.net/lists/listinfo/snort-users
> >
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users

--
Martin Roesch
roesch at ...421...
http://www.snort.org




More information about the Snort-users mailing list