Re: Diff'ing rulesets

["Chr. v. Stuckrad" <stucki () math fu-berlin de>]

Hi!

Just a small warning, what if somebody has 'broken' a rule
into several lines by adding '\' at the end of lines?

Like:
redalert tcp $EXTERNAL_NET any -> $SSH_AFFECTED 22     \
    (msg:"EXPLOIT ssh explicitely kill connection";  \
    resp:rst_all; \
    classtype:bad-known;)

So may be the third line was changed to
        resp:icmp_all

If somebody changes only *part* of (a partial line of!) a rule
the 'diff' catches only this *part* and possibly appends nonsense ?!

Sincerely yours,    Stucki

On Tue, Jan 08, 2002 at 10:47:18AM -0500, Andy Wood wrote:
...
> diff -b current_mod.rules new.rules | awk '/>/' | \
> ...
...
> I think this will work.....it worked here.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users