On Wed, Nov 12, 2008 at 09:50 +0100, you wrote: > Error in signature (.../policy/sigs/snort-default.sig:32): unknown script-level identifier (ssh_ports) Have you tried SSH::ssh_ports? Robin -- Robin Sommer * Phone +1 (510) 666-2886 * robin at icir.org ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org