From: Syke (r00t3dgmail.com)
Date: Tue Jul 06 2004 - 15:00:09 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

  The rule caused no problems for me in Snort 2.1.3 on Slackware Linux.

> On Tue, 6 Jul 2004 08:41:00 -0600, Rich Adamson <radamsonrouters.com> wrote:
> >
> > Could someone test the following rule in either linux or win32, please?
> >
> > alert tcp $HOME_NET any -> any any (msg: "High SYN Traffic"; flags:S; threshold: type
> > threshold, track by_src, seconds 60, count 1; classtype:misc-activity; sid: 1000002;
> > rev:1;)
> >
> > I'm trying to determine whether the above might indicate be a bug in
> > linux, win32, or syntax error on my part. If I try the above rule in win32
> > (v2.2.0rc1 build 28), snort will not start due to an integer error reading
> > the rule. Inserting content:" "; offset:0; in the above allows snort to
> > start.
> >
> > Any help/suggestions would be greatly appreciated. Off-list comments are
> > fine if you'd like.
> >
> > Rich
> >
> > -------------------------------------------------------
> > This SF.Net email sponsored by Black Hat Briefings & Training.
> > Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
> > digital self defense, top technical experts, no vendor pitches,
> > unmatched networking opportunities. Visit www.blackhat.com
> > _______________________________________________
> > Snort-users mailing list
> > Snort-userslists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
>

-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
digital self defense, top technical experts, no vendor pitches,
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]