[Snort-users] CVS Rule set problem - web-iis.rules
Bob Van Cleef
vancleef at ...211...
Wed Sep 12 11:50:02 EDT 2001
Two problems with the current CVS version.
1 - upon execution it fails with:
Sep 12 11:34:01 ns1 snort: FATAL ERROR: ERROR: web-iis.rules (88) =>
Unknown keyword "content="|25|25|25|25|25|25"" in rule!
2 - the web-iss.rules file that fails is the one in the CVS check
out directory, not the one it should be using.
I envoke snort at follows:
/usr/local/bin/snort -d -c
/usr/local/lib/snort/snort-1.8.1-RELEASE/snort.conf -i eth0 -D
In the snort.conf file are bunch of includes in the form of:
which are being sourced from the snort build directory, not the
directory that contains the snort.conf file. Changing it to:
eliminated the error, which is part of the new CVS rules.
It seems that my desires for automatic CVS rule updates were answered,
but not quite the way I expected.
><> ><> ><> ><> ><> ><> ><> ><> ><> ><> ><> ><> ><>
Bob Van Cleef, Member of Technical Staff (408) 734-8100
MicroUnity Systems Engineering, Inc. FAX (408) 734-8136
376 Martin Ave., Santa Clara, CA 95050 vancleef at ...211...
More information about the Snort-users