Ok so mystery solved. First let's go with what we know:
1. I suck =D
2. It WAS in snort.conf twice.
3. Reference #1 for any additional information =D
Thanks for the QUICKness of support that only open source can bring. Thanks
again gentlemen!!
James
-----Original Message-----
From: James Lay [mailto:jlay@ameriben.com]
Sent: Monday, February 21, 2005 5:41 PM
To: 'Frank Knobbe'
Cc: 'Snort-Sigs (E-mail)
Subject: RE: [Snort-sigs] Bleeding rules virus and threshold issue
Frank,
Yep...dig it:
[17:36:53 jlay@homebox:/etc/snort$] grep 2001578 *| wc -l
1
[17:37:02 jlay@homebox:/etc/snort$] cd rules
[17:37:05 jlay@homebox:/etc/snort/rules$] grep 2001578 *| wc -l
1
[17:37:06 jlay@homebox:/etc/snort/rules$]
In a word, ouchies.
James
-----Original Message-----
From: Frank Knobbe [mailto:frank@knobbe.us]
Sent: Monday, February 21, 2005 5:33 PM
To: James Lay
Cc: 'Snort-Sigs (E-mail)
Subject: RE: [Snort-sigs] Bleeding rules virus and threshold issue
On Mon, 2005-02-21 at 17:33 -0700, James Lay wrote:
FATAL ERROR: Rule-Threshold-Parse: could not create a threshold object --
only one per sid, sid = 2001578
That's insane...
What does
grep "sid:2001578" *|wc -l
show? Only 1???
From rom the corner,
Frank
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
