[Snort-users] CVS Rule set problem - web-iis.rules

Bob Van Cleef vancleef at ...211...
Wed Sep 12 11:50:02 EDT 2001


Two problems with the current CVS version.

1 - upon execution it fails with:

Sep 12 11:34:01 ns1 snort: FATAL ERROR:  ERROR: web-iis.rules (88) => 
Unknown keyword "content="|25|25|25|25|25|25"" in rule! 

2 - the web-iss.rules file that fails is the one in the CVS check
    out directory, not the one it should be using.

I envoke snort at follows:

/usr/local/bin/snort -d -c 
/usr/local/lib/snort/snort-1.8.1-RELEASE/snort.conf -i eth0 -D

In the snort.conf file are bunch of includes in the form of:
	include web-iis.rules
which are being sourced from the snort build directory, not the
directory that contains the snort.conf file.  Changing it to:
	include ./web-iis.rules
eliminated the error, which is part of the new CVS rules.

It seems that my desires for automatic CVS rule updates were answered,
but not quite the way I expected.

Bob
-- 
><>  ><>  ><>  ><>  ><>  ><>  ><>  ><>  ><>  ><>  ><>  ><>  ><>
Bob Van Cleef, Member of Technical Staff         (408) 734-8100
MicroUnity Systems Engineering, Inc.         FAX (408) 734-8136
376 Martin Ave., Santa Clara, CA 95050  vancleef at ...211...





More information about the Snort-users mailing list