[Snort-users] Threshold-Local None snort-2.7

Jeffrey Denton dentonj at ...11827...
Sun Jul 15 17:28:06 EDT 2007

I´m having a problem with snort-2.7.0 stable that was released on 12
July.  From /var/log/messages:


I´m running the VRT and BleedingThreat rule sets.  With snort-,
there were over 500 entries under the ¨thresholding-local¨ section.
Is anyone else experiencing the same problem?  There appears to be a
problem with snort processing the threshold options with the
signatures.  There is no change in the README.thresholding file
between the two versions of snort.

When I upgraded, I didn´t change any of the config files.  The only
problem that snort-2.7.0 complained about was with sid:2001846.  In
particular, the new version of snort did not like ¨icode: >1<5;¨.

More information about the Snort-users mailing list