Re: Snort 2.3.0 Final released!

[Nerijus Krukauskas <nk99 () delfi lt>]

Jeremy Hewlett wrote:
> * Threshold/Suppression now prints properly when logging to syslog.
>   Thanks Sekure for pointing out the problem. Thanks Steve Sturges for
>   working on the fix.
>
> * Threshold memcap argument now correctly handles non-integer input.
>   Thanks nnposter for the patch.

  Well, fixes for these two (I'm just guessing) broke the way the 
comments are handled in threshold/suppress configs. I'm used to put a 
short comment after threshold/suppress command in threshold.conf. That 
way I know why I've put it there. E.g.

suppress gen_id 1, sig_id 3003, track by_src, ip x.y.z.w  # hostname 
(MBSA/AV scans)

  snort-2.3.0 now barfs on me because of the slash (/) in comment. If 
I change it to dash (-), then it parses the command without errors.

  Am I not supposed to put comments this way or is this a small bug?

--
http://nk99.org/

... You will hear good news from one you thought unfriendly to you.



-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users