[Snort-users] Win32 v2.13 build 27 problem

Think I've discovered a problem with the current Win32 build.
Using the following rule:

alert tcp $HOME)NET any -> any any (msg: "High traffic host, SYN packets";
flags:S; threshold: type both, track by_src, count 4000, seconds 60;
classtype:misc-activity; sid: 1000002; rev:1;)

Snort complains with:
ERROR: *** threshold: count
*** Invaalid integer input: 4000
Fatal Error, Quitting...

If I swap "count 4000" with "seconds 60" (ordering only), the above error
is reported for seconds instead of count. Looks like the code to interpret
the integer that follows the parameter is not working correctly.

A search of the recent archives does not indicate anyone else with the
problem. Removing the above from the local.rules allows snort to operate
correctly. Reading the README.Thresolding text file tends to suggest the
above rule is constructed correctly.

Is this a known problem or is this new?

Rich




-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users