Rule Actions's Name lenght problem

[Mohamed LRHAZI <mohamed () lrhazi com>]

Hi all,

Maybe I am programing snort the wrong way... but  I did stumble on a little problem:
Using snort 1.7, Only the first three chars of the rule action name is significant! and is 
actually seen by Snort!  Is this known issue ? 

Example:
# cat toto.conf
var badguy 1.2.3.4

ruletype log1
{
 type log
 output log_tcpdump: log1.dump
}

ruletype log2
{
 type log
 output log_tcpdump: log2.dump
}


log1 tcp any any -> $badguy 21 (msg:"FTP Username"; content:"USER ";nocase; flags:A+;)
log2 tcp any any -> $badguy 21 (msg:"FTP Password"; content:"PASS ";nocase; flags:A+;)

# snort -c toto.conf -l log  -d -r capture.dump

Initializing rule chains...
ERROR line toto (3): Duplicate keyword: log1

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users