[Bro] ssh alternative ports

Robin Sommer robin at icir.org
Sun Nov 16 20:47:26 PST 2008


On Sat, Nov 15, 2008 at 16:39 +0100, you wrote:

>   Error in signature (policy/sigs/snort-default.sig:32): unknown script-level identifier (SSH)
>   Error in signature (policy/sigs/snort-default.sig:32): parse error
>   Error in signature (policy/sigs/dpd.sig:1): parse error

Oh, that looks like the signature parser can actually not deal with
module prefixes. The signatures were there before we introduced
modules and it looks like that never got adapted. :-( Something for
the todo list. 

Robin

-- 
Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org



More information about the Bro mailing list