[Snort-users] ERROR: ERROR /snortcenter/rules/snort.eth0.conf (88): Bad arguments to byte_test:

Paul Schmehl pauls at ...6838...
Sat Dec 20 10:41:02 EST 2003


--On Friday, December 19, 2003 20:46:32 -0500 Brian Toovey 
<admin at ...10794...> wrote:

> I have seen this posted, but does anybody know the solution yet?

The solution is staring you in the face.

[snipped all the irrelevant lines]

> ERROR: ERROR /snortcenter/rules/snort.eth0.conf (88): Bad arguments to
> byte_test:

You have a rule that uses "byte_test" and has bad arguments supplied to it. 
Grep for "byte_test" in your rules files and compare the results to the 
proper argumentation for byte_test.  (I would start with any custom rules 
that you've written, since it's unlikely that the rules supplied with snort 
with have this problem and go unnoticed by the community.)

You can find the section explaining byte_test in section 2.5.11 in the 
snort manual, which is available on the website as well as supplied with 
the tarball.  (Look in /doc/SnortUsersManual.pdf).  If you installed from 
an rpm or ports collection, download the tarball and untar it somewhere. 
You should have the manual available for ready reference anyway.

Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu




More information about the Snort-users mailing list