[Snort-users] Rule is already commented

Ronneil Camara ronneilc at ...4042...
Thu Jan 24 09:58:07 EST 2002


Just would like to know the reason.

I was doing a program which will keep your old rules including the commented rules.
It compares it the new rules.
I just actually grab another guys copy which is also on this list. But I have almost added many
conditional statements, and string streamings and modification in some lines to make 
the commenting in the new rule almost perfect. I will RELEASE it soon.

Here is what I did. As an example, I used web-iis.rules

1. I commented 8 lines
2. Run the script I made
3. Upon checking the new generated web-iis.rules, there were at least 13 lines that was commented.

So, I kept finding the problem in my script. Until 4 hours of troubleshooting, I opened
snortrules.tar.gz which I recently and opened web-iis.rules. I found out that there were
already commented rules there. :-) Even the cvs copy of web-iis.rules was already commented.

What would be the reason why it was commented?

Thanks.

Neil





More information about the Snort-users mailing list