[Snort-users] Shellcode.rules fatal error?

Matt Kettler mkettler at ...4108...
Sun May 12 14:15:02 EDT 2002


Aye, when updating your .rules files, make sure you check snort.conf for 
updates. The latest snort.conf should have SHELLCODE_PORTS defined.

At 10:27 PM 5/12/2002 +0200, piotr.bulczak at ...5615... wrote:

>[...]
> > FATAL ERROR: [!] ERROR shellcode.rules(14) => Bad port number:
> > "(msg:"SHELLCODE"
> >
> > If my count is correct - this should be #14:
> >
> > alert ip $EXTERNAL_NET any -> $HOME_NET $SHELLCODE_PORTS (msg:"SHELLCODE
> > x86 stealth NOOP"; content: "|eb 02 eb 02 eb 02|";
>reference:arachnids,291;
> > classtype:shellcode-detect; sid:651; rev:5;)
> >
> > what in this rule might cause such an error?  I have shellcodes disabled
>as
> > of now...
>
>Probably your variable SHELLCODE_PORTS is not defined or misconfigured in
>snort.conf file.
>
>Regards,
>Piotr
>
>
>
>
>_______________________________________________________________
>
>Have big pipes? SourceForge.net is looking for download mirrors. We supply
>the hardware. You get the recognition. Email Us: bandwidth at ...382...
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users





More information about the Snort-users mailing list