<HTML><HEAD><TITLE></TITLE>
<META name=GENERATOR
content="KsDHTMLEDLib.ocx, FreeWare HTML Editor 1.164.2, ?Kurt Senfer">
<META content="text/html; charset=GB2312" http-equiv=Content-Type></HEAD>
<BODY style="FONT-FAMILY: Consolas; FONT-SIZE: 9pt" leftMargin=5 topMargin=5
#ffffff>
<DIV>Hello,</DIV>
<DIV> </DIV>
<DIV>I am trying to make suricata-1.0.4 work. I simply wrote a test rule file:
sig.rules. It has only one line and one rule:</DIV>
<DIV>alert icmp any any -> $HOME_NET any (msg:"ICMP test"; classtype:
unknown; sid:10000001;) </DIV>
<DIV> </DIV>
<DIV>When I run it in in IPS mode:</DIV>
<DIV>suricata -s sig.rules -q 0</DIV>
<DIV> </DIV>
<DIV>There is error message showing the signature rule failed to be
compiled:</DIV>
<DIV> </DIV>
<DIV>[17915] 1/7/2011 -- 04:10:30 - (detect.c:366) <Info>
(SigLoadSignatures) -- Loading rule file: sig.rules<BR>[17915] 1/7/2011 --
04:10:30 - (detect.c:307) <Error> (DetectLoadSigFile) -- [ERRCODE:
SC_ERR_INVALID_SIGNATURE(39)] - Error parsing signature "alert icmp any any
-> $HOME_NET any (msg:"ICMP test"; classtype: unknown; sid:10000001;) " from
file sig.rules at line 1<BR>[17915] 1/7/2011 -- 04:10:30 - (detect.c:372)
<Error> (SigLoadSignatures) -- [ERRCODE: SC_ERR_NO_RULES(42)] - No rules
loaded from sig.rules<BR>[17915] 1/7/2011 -- 04:10:30 - (detect.c:392)
<Info> (SigLoadSignatures) -- 2 rule files processed. 1 rules succesfully
loaded, 1 rules failed<BR>[17915] 1/7/2011 -- 04:10:30 -
(detect-engine-sigorder.c:840) <Info> (SCSigOrderSignatures) -- ordering
signatures in memory<BR>SCSigOrderSignatures: Total Signatures to be processed
by thesigordering module: 1<BR>[17915] 1/7/2011 -- 04:10:30 -
(detect-engine-sigorder.c:883) <Info> (SCSigOrderSignatures) -- total
signatures reordered by the sigordering module: 1<BR>[17915] 1/7/2011 --
04:10:30 - (detect.c:1512) <Info> (SigAddressPrepareStage1) -- 1
signatures processed. 1 are IP-only rules, 0 are inspecting packet payload, 0
inspect application layer, 0 are decoder event only<BR>[17915] 1/7/2011 --
04:10:30 - (detect.c:1515) <Info> (SigAddressPrepareStage1) -- building
signature grouping structure, stage 1: adding signatures to signature source
addresses... done</DIV>
<DIV> </DIV>
<DIV>I tried other rules too. None of them suceeded. Please help me about it.
</DIV>
<DIV> </DIV>
<DIV>My os is Debian Squeeze 32-bit.</DIV>
<DIV> </DIV>
<DIV>Thanks so much for your help.</DIV>
<DIV> </DIV>
<DIV>Jankins</DIV></BODY></HTML>