[Emerging-Sigs] typo in sid 2008187

[Matt Jonkman]

Ya, they did with -T. I should be clear though, apparently the decision 
was made somewhere in the last few releases to not have snort complain 
or exit on bad rules. It was a surprise to everyone. I understand both 
ways, I just prefer to have snort SAY something when it hits a bad rule, 
and actually exit, vs silently ignoring it. But my please have landed 
upon deaf ears.

What's everyone else prefer?

Matt

Markus Lude wrote:
> On Sun, May 11, 2008 at 07:25:49AM -0400, Matt Jonkman wrote:
>> Good catch, thanks Markus.
>>
>> I wish Snort would tell you about this kind of thing....
> 
> Oddly older versions of snort seems to do this.
> 
> Regards,
> Markus
> 
>> Markus Lude wrote:
>>> Hello,
>>> there's a typo in sid 2008187:
>>>
>>>   content:"|0d 0a|User-Agent:";
>>>                             ^
>>>
>>> ":" needs to be escaped: "\:".
>>>
>>> Regards,
>>> Markus
>>> _______________________________________________
>>> Emerging-sigs mailing list
>>> Emerging-sigs at emergingthreats.net
>>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc