[Snort-users] Unknown keyword ' ftpbounce' in rule

Matthew Watchinski mwatchinski at ...1935...
Wed Apr 6 12:21:54 EDT 2005


Should read

"Snort 2.4 or higher is required to run CURRENT"

Thanks for pointing this out we'll get it updated shortly.

Cheers,
-matt

Pachulski, Keith wrote:

>http://www.snort.org/pub-bin/downloads.cgi
>
>"Snort 2.3.1 or higher is required to run CURRENT and 2.3 Rule Snapshots."
>
>-----Original Message-----
>From: Matthew Watchinski [mailto:mwatchinski at ...1935...]
>Sent: Wednesday, April 06, 2005 3:10 PM
>To: Snort-Users (E-mail)
>Subject: Re: [Snort-users] Unknown keyword ' ftpbounce' in rule
>
>
>If your running 2.3.2 you should download the 2.3 snapshot.  Currently 
>CURRENT tracks HEAD/2.4.  The ftpbounce keyword is in 2.4 and HEAD.
>
>Cheers,
>Matthew Watchinski
>Director, Vulnerability Research
>Sourcefire, Inc.
>
>Robert Bilbrey wrote:
>
>  
>
>>Had to comment it out, it is in the vrt ruleset, but snort doesn't 
>>recognize it.
>>
>>Pachulski, Keith wrote:
>>
>>    
>>
>>>Is anyone else getting this or just me? I searched for the ftpbounce 
>>>keyword in the 2.3.2 user manual and found nothing..
>>>
>>>ERROR: Warning: /home/snort/sigs/ftp.rules(119) => Unknown keyword ' 
>>>ftpbounce' in rule!
>>>Fatal Error, Quitting..
>>>
>>>[root at ...2768... snort-2.3.2]# snort -V
>>>
>>>   ,,_     -*> Snort! <*-
>>>  o"  )~   Version 2.3.2 (Build 12)
>>>   ''''    By Martin Roesch & The Snort Team: 
>>>http://www.snort.org/team.html
>>>           (C) Copyright 1998-2004 Sourcefire Inc., et al.
>>>
>>>|Keith A. Pachulski | PenTeleData LP1 Corporate Security Coordinator |
>>>|Phone: (800) 281.3564 x2454 | Pager: 6103497095 at ...10251...|
>>>|PGP: 6B56 C8DC 6201 6D1A BFF5  5799 E193 ABAA 9549 74D0|
>>>
>>>
>>>-------------------------------------------------------
>>>SF email is sponsored by - The IT Product Guide
>>>Read honest & candid reviews on hundreds of IT Products from real users.
>>>Discover which products truly live up to the hype. Start reading now.
>>>http://ads.osdn.com/?ad_ide95&alloc_id396&op=click
>>>_______________________________________________
>>>Snort-users mailing list
>>>Snort-users at lists.sourceforge.net
>>>Go to this URL to change user options or unsubscribe:
>>>https://lists.sourceforge.net/lists/listinfo/snort-users
>>>Snort-users list archive:
>>>http://www.geocrawler.com/redir-sf.php3?list=ort-users
>>>
>>>      
>>>
>>-------------------------------------------------------
>>SF email is sponsored by - The IT Product Guide
>>Read honest & candid reviews on hundreds of IT Products from real users.
>>Discover which products truly live up to the hype. Start reading now.
>>http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
>>_______________________________________________
>>Snort-users mailing list
>>Snort-users at lists.sourceforge.net
>>Go to this URL to change user options or unsubscribe:
>>https://lists.sourceforge.net/lists/listinfo/snort-users
>>Snort-users list archive:
>>http://www.geocrawler.com/redir-sf.php3?list=snort-users
>>
>>    
>>
>
>
>
>-------------------------------------------------------
>SF email is sponsored by - The IT Product Guide
>Read honest & candid reviews on hundreds of IT Products from real users.
>Discover which products truly live up to the hype. Start reading now.
>http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>-------------------------------------------------------
>SF email is sponsored by - The IT Product Guide
>Read honest & candid reviews on hundreds of IT Products from real users.
>Discover which products truly live up to the hype. Start reading now.
>http://ads.osdn.com/?ad_ide95&alloc_id396&op=click
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=ort-users
>
>  
>





More information about the Snort-users mailing list