<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
  </head>
  <body bgcolor="#ffffff" text="#000000">
    when compiling snort WITHOUT flexresp3, SDF rules will fail:<br>
    <br>
    ERROR: /usr/local/etc/snort/./preproc_rules/sensitive-data.rules(1)
    Rules with SDF options cannot have other detection options in the
    same rule.<br>
    <br>
    this ./configure:<br>
    <br>
    --enable-dynamicplugin --enable-build-dynamic-examples 
    --enable-reload --enable-reload-restart  --disable-corefiles 
    --with-dnet-includes=/usr/local/include/libnet11 
    --with-dnet-libraries=/usr/local/lib/libnet11 --with-mysql=no
    --with-odbc=no --with-postgresql=no --disable-prelude --enable-gre
    --enable-mpls --enable-decoder-preprocessor-rules
    --enable-zlib-enable-normalizer --prefix=/usr/local<br>
    <br>
    i googled, but only see this: (with no answer yet)<br>
    <a class="moz-txt-link-rfc2396E" href="http://seclists.org/snort/2010/q2/826"><http://seclists.org/snort/2010/q2/826></a><br>
    <br>
    if the answer is 'add --enable-flexresp3'.  then fine, but it
    doesn't make sense unless I don't understand the error.<br>
    <br>
    stock sensitive-data.rules:<br>
    <br>
    alert tcp $HOME_NET any -> $EXTERNAL_NET [80,20,25,143,110]
    (msg:"SENSITIVE-DATA Credit Card Numbers"; metadata:service <br>
    http, service smtp, service ftp-data, service imap, service pop3;
    sd_pattern:2,credit_card; classtype:sdf; sid:2; gid:138;<br>
    rev:1;)<br>
    <br>
    <br>
    <div class="moz-signature">-- <br>
      Michael Scheidell, CTO<br>
      o: 561-999-5000<br>
      d: 561-948-2259<br>
      ISN: 1259*1300<br>
      <font color="#999999">></font><font color="#cc0000"> <b>| </b></font>SECNAP
      Network Security Corporation
      <style type="text/css">
<!--
.unnamed1 {
        margin: 1em;
        padding: 1px;
} -->
</style>
      <ul class="unnamed1">
        <li>Certified SNORT Integrator</li>
        <li>2008-9 Hot Company Award Winner, World Executive Alliance</li>
        <li>Five-Star Partner Program 2009, VARBusiness</li>
        <li>Best in Email Security,2010: Network Products Guide</li>
        <li>King of Spam Filters, SC Magazine 2008</li>
      </ul>
    </div>
  
<br>
<div id="disclaimer.secnap.com"><hr />
<p>This email has been scanned and certified safe by SpammerTrap®.
<br />For Information please see
<a href="http://www.secnap.com/products/spammertrap/">http://www.secnap.com/products/spammertrap/</a></p> <hr /></div>
<br>
</body>
</html>