<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Thanks Joel.<br><br><div><hr id="stopSpelling">Subject: Re: [Snort-users] Warning after rules update<br>From: jesler@...1935...<br>Date: Wed, 11 Sep 2013 09:45:54 -0400<br>CC: snort-users@lists.sourceforge.net<br>To: snort@...15979...<br><br>On Sep 11, 2013, at 7:11 AM, Y M <<a href="mailto:snort@...15979...">snort@...16052...9...</a>> wrote:<br><div><br class="ecxApple-interchange-newline"><blockquote><span style="font-family:Calibri;font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;display:inline !important;">After running an update to the latest rules tarball (2.9.5.3), I get the following warning:</span><div style="font-family:Calibri;font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;"><br></div><div style="font-family:Calibri;font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;">"WARNING: /path/to/snort.rules(8912) at most one HTTP buffer may be indicated with pcre"</div><div style="font-family:Calibri;font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;"><br></div><div style="font-family:Calibri;font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;">Line 8912 points to sid:6343. I am using PulledPork v0.7.0 to generate the rules. Any ideas why?</div></blockquote></div><br><div>Yes.  The pcre read “HsmiH”.</div><div><br></div><div>I fixed it.  It’ll be in the next rule release.  </div><div><br></div><div><br></div></div>                                      </div></body>
</html>