[Snort-users] Warning after rules update

Y M snort at ...15979...
Wed Sep 11 07:11:27 EDT 2013


After running an update to the latest rules tarball (2.9.5.3), I get the following warning:
"WARNING: /path/to/snort.rules(8912) at most one HTTP buffer may be indicated with pcre"
Line 8912 points to sid:6343. I am using PulledPork v0.7.0 to generate the rules. Any ideas why?
Thanks.YM 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130911/14f806f9/attachment.html>


More information about the Snort-users mailing list