[Snort-users] Broken config directive? or just me?

Matt Kettler mkettler at ...4108...
Tue Apr 29 17:11:11 EDT 2003


At 06:47 PM 4/29/2003 -0400, Sam Evans wrote:
>Per the Snort 2.0.0 manual it says that this should be a valid config
>directive in your snort.conf :
>
>config disable_tcpopt_ttcp_alerts

It appears to be a copy-paste typo.

some grep output:
src/parser.c:    else if(!strcasecmp(config, "disable_ttcp_alerts"))

So that really should be "config disable_ttcp_alerts" to actually do what 
the docs claim that "disable_tcpopt_ttcp_alerts " does. Also the word 
"options" should be dropped from the description. TCP options and T/TCP are 
totally separate things.


The docs should be updated to reflect the correct name :
http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.1.3 





More information about the Snort-users mailing list