<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><div><br>On 6 aug 2014, at 13:23, Kevin Ross <<a href="mailto:kevross33@googlemail.com">kevross33@googlemail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div>ah that is it. I must have eyed past that a dozen times when checking the rule for these errors. I had it duplicated because I was incrementing the sid.<br></div></div></div></blockquote><div><br></div><div>Is this behavior the same with Suricata 2.0.2?</div><div><br></div><div><br></div><br><blockquote type="cite"><div><div dir="ltr"><div><br>Thanks,<br>Kevin<br></div></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On 6 August 2014 12:23, Victor Julien <span dir="ltr"><<a href="mailto:lists@inliniac.net" target="_blank">lists@inliniac.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="">On 08/06/2014 01:10 PM, Kevin Ross wrote:<br>
> Correction on paragraph so it makes sense (tired):<br>
><br>
> I am trying out some local sigs. Whenever I enable this rule or even<br>
> strip out some of the content matches it just segfaults. I have others<br>
> like it too and they all do the same but I cannot seem to spot what is<br>
> wrong. I thought if there is an error in the rule syntax it should just<br>
> skip over it anyway? I am using version 2.0 on this sensor.<br>
><br>
><br>
> On 6 August 2014 12:09, Kevin Ross <<a href="mailto:kevross33@googlemail.com">kevross33@googlemail.com</a><br>
</div><div class="">> <mailto:<a href="mailto:kevross33@googlemail.com">kevross33@googlemail.com</a>>> wrote:<br>
><br>
> Hi,<br>
><br>
> I am trying out some local sigs. Whenever I enable this rule or even<br>
> strip out some of the content matches it just segfaults. I have<br>
> others like it too and they all reach the same but I cannot seem to<br>
> spot what is wrong and I though if there is an error in the rule<br>
> syntax it should just skip over it anyway? I am using version 2.0 on<br>
> this sensor.<br>
><br>
> alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-CNC<br>
> Potential CnC Response DONE"; flow:established,to_client;<br>
> content:"200"; http_stat_code; content:"OK"; http_stat_msg;<br>
> content:"Content-Length|3A| 4|0D 0A|"; http_header; file_data;<br>
> content:"DONE"; within:4; classtype:trojan-activity; sid:1769992;<br>
> rev;1;)<br>
<br>
</div>This rev is probably it: 'rev;1;' should be 'rev:1;'<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br>
</font></span></blockquote></div><br></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a></span><br><span>Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a></span><br><span>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a></span><br><span>OISF: <a href="http://www.openinfosecfoundation.org/">http://www.openinfosecfoundation.org/</a></span></div></blockquote></body></html>