[Snort-users] Warning after rules update

Y M snort at ...15979...
Wed Sep 11 09:54:51 EDT 2013


Thanks Joel.

Subject: Re: [Snort-users] Warning after rules update
From: jesler at ...1935...
Date: Wed, 11 Sep 2013 09:45:54 -0400
CC: snort-users at lists.sourceforge.net
To: snort at ...15979...

On Sep 11, 2013, at 7:11 AM, Y M <snort at ...15979...> wrote:
After running an update to the latest rules tarball (2.9.5.3), I get the following warning:
"WARNING: /path/to/snort.rules(8912) at most one HTTP buffer may be indicated with pcre"
Line 8912 points to sid:6343. I am using PulledPork v0.7.0 to generate the rules. Any ideas why?
Yes.  The pcre read “HsmiH”.
I fixed it.  It’ll be in the next rule release.  

 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130911/5eadd84e/attachment.html>


More information about the Snort-users mailing list