Re: Encoded Rule Plugin SID: 16329, GID: 3 not registered properly. Disabling this rule.

[waldo kitty <wkitty42 () windstream net>]

On 3/28/2014 9:49 AM, Vona, Steven A CIV NSWCCD Philadelphia, 34117 wrote:
> Yes, snort has access to the so_rules directory and it is populated with .rules files that snort also has access to.

is it populated with .rules stub files for /all/ of the rules your system is 
trying to use? IIUC, the respondent was asking if both parts of all the GID:3 
rules were in place... if one part is missing, the rule won't be loaded...

-- 
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!