[Snort-users] Re: flowbits

adam hoga4008 at ...11285...
Tue Feb 24 18:03:04 EST 2004


I don't speak for the Snort team, but I imagine that it's just too much 
work to maintain a seperate tree of rules for every release of Snort.  
This field changes too fast for everything to be simple and automated, 
updating regularly is just something we'll have to accept.  If we want 
the newest greatest signatures we need the newest greatest Snort features.

-adam.

>I agree,
>
>I don't think I understand the reasoning of introducing a rule for a =
>feature that did not exist in the current stable release knowing that =
>Snort would break. I use Oinkmaster and I had to find the rules that had =
>flowbits enabled and disablesid them.
>
>Snort Team: Why don't you create a new ruleset for RC1 until 2.1.1 is =
>released? BTW, RC1 doesn't exist for Windows or I'd give that a shot =
>too.
>
>Doug
>
>-----Original Message-----
>From: Andreas =D6stling [mailto:andreaso at ...236...]=20
>Sent: Tuesday, February 24, 2004 1:51 PM
>To: snort-users at lists.sourceforge.net
>Subject: Re: [Snort-users] Re: flowbits
>
>
>
>On http://www.snort.org/dl/rules/ it still says you should use the 2_1=20
>rules for snort 2.1.*, which will obviously fail as the flowbit feature=20
>was introduced post 2.1.0 (as discussed in=20
>http://marc.theaimsgroup.com/?t=3D107661847900002&r=3D1&w=3D2)
>
>Couldn't this be fixed somehow?
>
>/Andreas
>
>
>  
>
>






More information about the Snort-users mailing list