[Snort-users] Shellcode.rules fatal error?

piotr.bulczak at ...5615... piotr.bulczak at ...5615...
Sun May 12 13:18:03 EDT 2002


[...]
> FATAL ERROR: [!] ERROR shellcode.rules(14) => Bad port number:
> "(msg:"SHELLCODE"
>
> If my count is correct - this should be #14:
>
> alert ip $EXTERNAL_NET any -> $HOME_NET $SHELLCODE_PORTS (msg:"SHELLCODE
> x86 stealth NOOP"; content: "|eb 02 eb 02 eb 02|";
reference:arachnids,291;
> classtype:shellcode-detect; sid:651; rev:5;)
>
> what in this rule might cause such an error?  I have shellcodes disabled
as
> of now...

Probably your variable SHELLCODE_PORTS is not defined or misconfigured in
snort.conf file.

Regards,
Piotr







More information about the Snort-users mailing list