[Snort-users] Help w/ Bleeding Snort Rules on XP

James Bruce jbruce at ...13308...
Fri Jun 10 07:32:49 EDT 2005


Michael, thanks for the reply. WordPad is a lot easier then notepad.
Wish WordPad had a line counter though. Anyway, I ended up having to go
through the rules line by line (as Patrick mentioned..thanks) and
commented out some lines. Everything works fine now. Now for sure what
in the line wouldn't make it work. I've never wrote a rule..but
learning. Here is an example.

ERROR: D:\win-ids\Snort\rules\bleeding-virus.rules(304) =>
getservbyname() faile
d on "any"
Fatal Error, Quitting..

This is line 304 for MyDoom.AH in the rule. If I comment that out, snort
doesn't give me any errors.


alert tcp $HOME_NET !$HTTP_PORTS -> $EXTERNAL_NET 1639:1640
(msg:"BLEEDING-EDGE WORM MyDoom.AH Victim Accessing Infected Page";
classtype:trojan-activity; flow:established,to_server;
content:"/index.htm"; nocase;
reference:url,us.mcafee.com/virusInfo/default.asp?id=description&virus_k
=129631; sid:2001428; rev:6;)

Thanks again to everyone who replied for the help.
-Jimmy 



-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Michael
Steele
Sent: Thursday, June 09, 2005 7:06 PM
To: James Bruce; snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] Help w/ Bleeding Snort Rules on XP


Ok, you might have a problem with using 'Notepad' try 'WordPad'. Not
sure why you have to copy and paste. The rules should be available in an
archive format. Don't modify any of the rules and see if the error comes
back. If there is no error then try to modify with 'Notepad', and if the
error comes back you have the culprit.

Kindest regards,
Michael...

WINSNORT.com Management Team Member
--
Pick up your FREE Windows or UNIX Snort installation guides
mailto:support at ...9077...
Website: http://www.winsnort.com
Snort: Open Source Network IDS - http://www.snort.org






More information about the Snort-users mailing list