Re: Shellcode.rules fatal error?

[piotr.bulczak () pl abb com]

[...]
> FATAL ERROR: [!] ERROR shellcode.rules(14) => Bad port number:
> "(msg:"SHELLCODE"
>
> If my count is correct - this should be #14:
>
> alert ip $EXTERNAL_NET any -> $HOME_NET $SHELLCODE_PORTS (msg:"SHELLCODE
> x86 stealth NOOP"; content: "|eb 02 eb 02 eb 02|";
reference:arachnids,291;
> classtype:shellcode-detect; sid:651; rev:5;)
>
> what in this rule might cause such an error?  I have shellcodes disabled
as
> of now...

Probably your variable SHELLCODE_PORTS is not defined or misconfigured in
snort.conf file.

Regards,
Piotr




_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users