[Snort-users] Warning after rules update

Y M snort at ...15979...
Wed Sep 11 07:11:27 EDT 2013

After running an update to the latest rules tarball (, I get the following warning:
"WARNING: /path/to/snort.rules(8912) at most one HTTP buffer may be indicated with pcre"
Line 8912 points to sid:6343. I am using PulledPork v0.7.0 to generate the rules. Any ideas why?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130911/14f806f9/attachment.html>

More information about the Snort-users mailing list