[Snort-users] Threshold-Local None snort-2.7
dentonj at ...11827...
Sun Jul 15 17:28:06 EDT 2007
I´m having a problem with snort-2.7.0 stable that was released on 12
July. From /var/log/messages:
I´m running the VRT and BleedingThreat rule sets. With snort-188.8.131.52,
there were over 500 entries under the ¨thresholding-local¨ section.
Is anyone else experiencing the same problem? There appears to be a
problem with snort processing the threshold options with the
signatures. There is no change in the README.thresholding file
between the two versions of snort.
When I upgraded, I didn´t change any of the config files. The only
problem that snort-2.7.0 complained about was with sid:2001846. In
particular, the new version of snort did not like ¨icode: >1<5;¨.
More information about the Snort-users