[Snort-users] disabled flowbits?

waldo kitty wkitty42 at ...14940...
Thu Aug 19 13:44:23 EDT 2010


can someone please explain why these broken SIDs are not also disabled when the 
required flowbit setting SID is disabled??


WARNING: SID 13865 depends on flowbit "http.bmp" which is set in INACTIVE SID 
16205 (SID 13865 is broken unless you also enable SID 16205).

WARNING: SID 13712 depends on flowbit "tlsv1.client_hello.request" which is set 
in INACTIVE SID 3059 (SID 13712 is broken unless you also enable SID 3059).

WARNING: SID 13711 depends on flowbit "tlsv1.client_hello.request" which is set 
in INACTIVE SID 3059 (SID 13711 is broken unless you also enable SID 3059).

WARNING: SID 13714 depends on flowbit "tlsv1.client_hello.request" which is set 
in INACTIVE SID 3059 (SID 13714 is broken unless you also enable SID 3059).

WARNING: SID 13710 depends on flowbit "tlsv1.client_hello.request" which is set 
in INACTIVE SID 3059 (SID 13710 is broken unless you also enable SID 3059).

WARNING: SID 13585 depends on flowbit "csv.download" which is set in INACTIVE 
SID 13584 (SID 13585 is broken unless you also enable SID 13584).

WARNING: SID 13713 depends on flowbit "tlsv1.client_hello.request" which is set 
in INACTIVE SID 3059 (SID 13713 is broken unless you also enable SID 3059).





More information about the Snort-users mailing list