CVS Rule set problem - web-iis.rules

[Bob Van Cleef <vancleef () microunity com>]

Two problems with the current CVS version.

1 - upon execution it fails with:

Sep 12 11:34:01 ns1 snort: FATAL ERROR:  ERROR: web-iis.rules (88) => 
Unknown keyword "content="|25|25|25|25|25|25"" in rule! 

2 - the web-iss.rules file that fails is the one in the CVS check
    out directory, not the one it should be using.

I envoke snort at follows:

/usr/local/bin/snort -d -c 
/usr/local/lib/snort/snort-1.8.1-RELEASE/snort.conf -i eth0 -D

In the snort.conf file are bunch of includes in the form of:
        include web-iis.rules
which are being sourced from the snort build directory, not the
directory that contains the snort.conf file.  Changing it to:
        include ./web-iis.rules
eliminated the error, which is part of the new CVS rules.

It seems that my desires for automatic CVS rule updates were answered,
but not quite the way I expected.

Bob
-- 
> <>  ><>  ><>  ><>  ><>  ><>  ><>  ><>  ><>  ><>  ><>  ><>  ><>
Bob Van Cleef, Member of Technical Staff         (408) 734-8100
MicroUnity Systems Engineering, Inc.         FAX (408) 734-8136
376 Martin Ave., Santa Clara, CA 95050  vancleef () microunity com


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users