Generally it's ok to post a VRT rule to this list for verification or
discussion on errors, false positives, etc - or if you'd like to submit
an improvement to a rule. We'd also ask that when you're discussing
an issue like this to please copy vrt@sourcefire.com on the message.
The team does monitor this list to get this type of data but I'd just
like to make sure that the VRT sees the message.
Gentoo-Wally wrote:
I'm sorry it is 9622 and not 6922. It is rev 1 and the message is "DOS
Spiffit UDP denial of service attempt"
For future reference, is it ok to post a rule to this list from the VRT set?
Thx Wally
On 3/24/07, Joel Esler <joel.esler@sourcefire.com> wrote:
what rule rev is it?
+---------------------------------------------------------------------+
Joel Esler Security Consultant
gpg key: http://demo.sourcefire.com/jesler.pgp.key
+---------------------------------------------------------------------+
On Mar 23, 2007, at 3:29 PM, Gentoo-Wally wrote:
Hi,
I'm running snort 2.6.0 and SID: 6922 from the VRT set is causing
snort to fail to start. It gives the following error...
snort: ERROR: <rules file location removed> : pcre compile of
"^[\x00]?+" failed at offset 8 : nothing to repeat.
Can anyone else verify this?
Wally
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
--
Mike Guiterman
Snort Community Manager
Sourcefire, Inc.
mguiterman@sourcefire.com
(410)423-1930
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
