Snort mailing list archives
[PATCH] Remove the variable modifiers section in the manual.
From: Joshua Kinard <kumba () gentoo org>
Date: Mon, 26 Dec 2011 19:24:51 -0500
I checked again to see if the bash-like variable modifiers work in Snort with the newer releases. They do not: portvar HTTP_PORT 80 alert tcp any any -> any $(HTTP_PORT?FOOBAR) (msg:"HTTP GET for ~/hello"; flow:established,to_server; content:"GET"; http_method; content:"/~hello"; http_uri; sid:42000001; rev:1; classtype:misc-activity; ) $ ~/bin/snort -c local.rules -A console -k none -r tcp-http-tiny2.pcap -q ERROR: local.rules(216) ***PortVar Lookup failed on '$(HTTP_PORT?FOOBAR)'. Fatal Error, Quitting.. So, lets get rid of that section. Changes: snort_manual.tex | 46 ---------------------------------------------- 1 file changed, 46 deletions(-) Cheers! -- Joshua Kinard Gentoo/MIPS kumba () gentoo org 4096R/D25D95E3 2011-03-28 "The past tempts us, the present confuses us, the future frightens us. And our lives slip away, moment by moment, lost in that vast, terrible in-between." --Emperor Turhan, Centauri Republic
Attachment:
snort-2.9.2-kill-variable-modifiers.patch
Description:
------------------------------------------------------------------------------ Write once. Port to many. Get the SDK and tools to simplify cross-platform app development. Create new or port existing apps to sell to consumers worldwide. Explore the Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join http://p.sf.net/sfu/intel-appdev
_______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- [PATCH] Remove the variable modifiers section in the manual. Joshua Kinard (Dec 26)
