author | Mike Sullivan <Mike.Sullivan@Oracle.COM> |
Thu, 05 May 2011 10:28:18 -0700 | |
changeset 213 | 7d4229dba5ed |
child 1345 | ee87318d9935 |
permissions | -rw-r--r-- |
213
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
1 |
--- etc/snort.conf.orig Wed Mar 11 21:22:03 2009 |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
2 |
+++ etc/snort.conf Wed May 20 15:22:07 2009 |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
3 |
@@ -191,27 +191,27 @@ |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
4 |
# Load all dynamic preprocessors from the install path |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
5 |
# (same as command line option --dynamic-preprocessor-lib-dir) |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
6 |
# |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
7 |
-dynamicpreprocessor directory /usr/local/lib/snort_dynamicpreprocessor/ |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
8 |
+dynamicpreprocessor directory /usr/lib/snort_dynamicpreprocessor/ |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
9 |
# |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
10 |
# Load a specific dynamic preprocessor library from the install path |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
11 |
# (same as command line option --dynamic-preprocessor-lib) |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
12 |
# |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
13 |
-# dynamicpreprocessor file /usr/local/lib/snort_dynamicpreprocessor/libdynamicexample.so |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
14 |
+# dynamicpreprocessor file /usr/lib/snort_dynamicpreprocessor/libdynamicexample.so |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
15 |
# |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
16 |
# Load a dynamic engine from the install path |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
17 |
# (same as command line option --dynamic-engine-lib) |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
18 |
# |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
19 |
-dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
20 |
+dynamicengine /usr/lib/snort_dynamicengine/libsf_engine.so |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
21 |
# |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
22 |
# Load all dynamic rules libraries from the install path |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
23 |
# (same as command line option --dynamic-detection-lib-dir) |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
24 |
# |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
25 |
-# dynamicdetection directory /usr/local/lib/snort_dynamicrule/ |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
26 |
+# dynamicdetection directory /usr/lib/snort_dynamicrule/ |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
27 |
# |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
28 |
# Load a specific dynamic rule library from the install path |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
29 |
# (same as command line option --dynamic-detection-lib) |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
30 |
# |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
31 |
-# dynamicdetection file /usr/local/lib/snort_dynamicrule/libdynamicexamplerule.so |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
32 |
+# dynamicdetection file /usr/lib/snort_dynamicrule/libdynamicexamplerule.so |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
33 |
# |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
34 |
|
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
35 |
################################################### |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
36 |
@@ -307,11 +307,11 @@ |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
37 |
# lots of options available here. See doc/README.http_inspect. |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
38 |
# unicode.map should be wherever your snort.conf lives, or given |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
39 |
# a full path to where snort can find it. |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
40 |
-preprocessor http_inspect: global \ |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
41 |
- iis_unicode_map unicode.map 1252 |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
42 |
+#preprocessor http_inspect: global \ |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
43 |
+# iis_unicode_map unicode.map 1252 |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
44 |
|
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
45 |
-preprocessor http_inspect_server: server default \ |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
46 |
- profile all ports { 80 8080 8180 } oversize_dir_length 500 |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
47 |
+#preprocessor http_inspect_server: server default \ |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
48 |
+# profile all ports { 80 8080 8180 } oversize_dir_length 500 |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
49 |
|
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
50 |
# |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
51 |
# Example unique server configuration |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
52 |
@@ -760,7 +760,7 @@ |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
53 |
# such as: c:\snort\etc\classification.config |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
54 |
# |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
55 |
|
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
56 |
-include classification.config |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
57 |
+#include classification.config |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
58 |
|
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
59 |
# |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
60 |
# Include reference systems |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
61 |
@@ -768,7 +768,7 @@ |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
62 |
# such as: c:\snort\etc\reference.config |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
63 |
# |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
64 |
|
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
65 |
-include reference.config |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
66 |
+#include reference.config |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
67 |
|
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
68 |
#################################################################### |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
69 |
# Step #5: Configure snort with config statements |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
70 |
@@ -807,45 +807,45 @@ |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
71 |
# README.alert_order for how rule ordering affects how alerts are triggered. |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
72 |
#========================================= |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
73 |
|
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
74 |
-include $RULE_PATH/local.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
75 |
-include $RULE_PATH/bad-traffic.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
76 |
-include $RULE_PATH/exploit.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
77 |
-include $RULE_PATH/scan.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
78 |
-include $RULE_PATH/finger.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
79 |
-include $RULE_PATH/ftp.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
80 |
-include $RULE_PATH/telnet.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
81 |
-include $RULE_PATH/rpc.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
82 |
-include $RULE_PATH/rservices.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
83 |
-include $RULE_PATH/dos.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
84 |
-include $RULE_PATH/ddos.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
85 |
-include $RULE_PATH/dns.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
86 |
-include $RULE_PATH/tftp.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
87 |
+# include $RULE_PATH/local.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
88 |
+# include $RULE_PATH/bad-traffic.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
89 |
+# include $RULE_PATH/exploit.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
90 |
+# include $RULE_PATH/scan.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
91 |
+# include $RULE_PATH/finger.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
92 |
+# include $RULE_PATH/ftp.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
93 |
+# include $RULE_PATH/telnet.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
94 |
+# include $RULE_PATH/rpc.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
95 |
+# include $RULE_PATH/rservices.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
96 |
+# include $RULE_PATH/dos.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
97 |
+# include $RULE_PATH/ddos.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
98 |
+# include $RULE_PATH/dns.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
99 |
+# include $RULE_PATH/tftp.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
100 |
|
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
101 |
-include $RULE_PATH/web-cgi.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
102 |
-include $RULE_PATH/web-coldfusion.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
103 |
-include $RULE_PATH/web-iis.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
104 |
-include $RULE_PATH/web-frontpage.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
105 |
-include $RULE_PATH/web-misc.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
106 |
-include $RULE_PATH/web-client.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
107 |
-include $RULE_PATH/web-php.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
108 |
+# include $RULE_PATH/web-cgi.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
109 |
+# include $RULE_PATH/web-coldfusion.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
110 |
+# include $RULE_PATH/web-iis.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
111 |
+# include $RULE_PATH/web-frontpage.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
112 |
+# include $RULE_PATH/web-misc.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
113 |
+# include $RULE_PATH/web-client.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
114 |
+# include $RULE_PATH/web-php.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
115 |
|
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
116 |
-include $RULE_PATH/sql.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
117 |
-include $RULE_PATH/x11.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
118 |
-include $RULE_PATH/icmp.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
119 |
-include $RULE_PATH/netbios.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
120 |
-include $RULE_PATH/misc.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
121 |
-include $RULE_PATH/attack-responses.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
122 |
-include $RULE_PATH/oracle.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
123 |
-include $RULE_PATH/mysql.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
124 |
-include $RULE_PATH/snmp.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
125 |
+# include $RULE_PATH/sql.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
126 |
+# include $RULE_PATH/x11.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
127 |
+# include $RULE_PATH/icmp.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
128 |
+# include $RULE_PATH/netbios.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
129 |
+# include $RULE_PATH/misc.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
130 |
+# include $RULE_PATH/attack-responses.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
131 |
+# include $RULE_PATH/oracle.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
132 |
+# include $RULE_PATH/mysql.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
133 |
+# include $RULE_PATH/snmp.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
134 |
|
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
135 |
-include $RULE_PATH/smtp.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
136 |
-include $RULE_PATH/imap.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
137 |
-include $RULE_PATH/pop2.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
138 |
-include $RULE_PATH/pop3.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
139 |
+# include $RULE_PATH/smtp.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
140 |
+# include $RULE_PATH/imap.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
141 |
+# include $RULE_PATH/pop2.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
142 |
+# include $RULE_PATH/pop3.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
143 |
|
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
144 |
-include $RULE_PATH/nntp.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
145 |
-include $RULE_PATH/other-ids.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
146 |
+# include $RULE_PATH/nntp.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
147 |
+# include $RULE_PATH/other-ids.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
148 |
# include $RULE_PATH/web-attacks.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
149 |
# include $RULE_PATH/backdoor.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
150 |
# include $RULE_PATH/shellcode.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
151 |
@@ -859,7 +859,7 @@ |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
152 |
# include $RULE_PATH/p2p.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
153 |
# include $RULE_PATH/spyware-put.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
154 |
# include $RULE_PATH/specific-threats.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
155 |
-include $RULE_PATH/experimental.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
156 |
+# include $RULE_PATH/experimental.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
157 |
|
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
158 |
# include $PREPROC_RULE_PATH/preprocessor.rules |
7d4229dba5ed
7041863 move snort to userland
Mike Sullivan <Mike.Sullivan@Oracle.COM>
parents:
diff
changeset
|
159 |
# include $PREPROC_RULE_PATH/decoder.rules |