[Snort-users] Pass rules need SID in 2.6.1

James Lay jlay at ...13475...
Fri Nov 17 06:12:26 EST 2006


Hrmmm:

Nov 17 04:07:33 myshield snort[29024]: FATAL
ERROR: /chroot/snort/etc/snort/rules/myshield.rules(1) => Each rule
must contain a Rule-sid

myshield.rules:

pass icmp $EXTERNAL_NET any -> $HOME_NET any (icode:3; itype:3;)
pass icmp any any -> any any (icode:13; itype:3;)

Looked in the docs but didn't see why this is now...

James




More information about the Snort-users mailing list