Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Users
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[Snort-users] Threshold-Local None snort-2.7

from [Jeffrey Denton] Network Security [Permanent Link]
Subject: [Snort-users] Threshold-Local None snort-2.7
Date: Sun, 15 Jul 2007 23:28:06 +0200 
I´m having a problem with snort-2.7.0 stable that was released on 12
July.  From /var/log/messages:

-----[thresholding-local]-----
none

I´m running the VRT and BleedingThreat rule sets.  With snort-2.6.1.5,
there were over 500 entries under the ¨thresholding-local¨ section.
Is anyone else experiencing the same problem?  There appears to be a
problem with snort processing the threshold options with the
signatures.  There is no change in the README.thresholding file
between the two versions of snort.

When I upgraded, I didn´t change any of the config files.  The only
problem that snort-2.7.0 complained about was with sid:2001846.  In
particular, the new version of snort did not like ¨icode: >1<5;¨.

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • [Snort-users] Threshold-Local None snort-2.7, Jeffrey Denton <=
Previous by Date:  Re: [Snort-users] QUESTION: use Snort to benchmark silicon, Matthew Watchinski
Next by Date:  [Snort-users] Snort 2.7.0 thresholding-local none, Jeffrey Denton
Previous by Thread:  [Snort-users] QUESTION: use Snort to benchmark silicon, Chu Chen-Chau-ra9643
Next by Thread:  [Snort-users] Snort 2.7.0 thresholding-local none, Jeffrey Denton
Indexes:  [Date] [Thread] [Top] [All Lists]