Project

General

Profile

Actions
Copy link

Bug #303

closed

unknown rule keyword 'replace'

Added by Peter Manev over 13 years ago. Updated about 13 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Eric Leblond
Target version:
1.1beta3
Affected Versions:
Effort:
Difficulty:
Label:

Description

[11180] 27/7/2011 -- 10:33:15 - (detect-parse.c:675) <Error> (SigParseOptions) -- [ERRCODE: SC_ERR_RULE_KEYWORD_UNKNOWN(100)] - unknown rule keyword 'replace'.

[11180] 27/7/2011 -- 10:33:15 - (detect.c:503) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 5050 (msg:"CONTENT-REPLACE Yahoo Messenger deny outbound login attempt"; flow:established,to_server; content:"YMSG"; depth:4; content:"|00|W"; depth:2; offset:10; replace:"|FF FF|"; classtype:policy-violation; sid:15429; rev:2;)" from file /etc/suricata/rules/content-replace.rules at line 39

[11180] 27/7/2011 -- 10:33:15 - (detect-parse.c:675) <Error> (SigParseOptions) -- [ERRCODE: SC_ERR_RULE_KEYWORD_UNKNOWN(100)] - unknown rule keyword 'replace'.

[11180] 27/7/2011 -- 10:33:15 - (detect.c:503) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"CONTENT-REPLACE QQ 2009 deny tcp login"; flow:established,to_server; content:"|00|N|02 12|Q|00|"; depth:6; replace:"|FF FF FF FF FF FF|"; metadata:policy security-ips alert; classtype:policy-violation; sid:15441; rev:1;)" from file /etc/suricata/rules/content-replace.rules at line 42

Files

ticket303.tgz (7.88 KB) ticket303.tgz Patchset adding 'replace' keyword Eric Leblond, 08/17/2011 07:53 AM
Actions
Copy link

Also available in: Atom PDF