My IPS is not even initializing correctly. Its stuck in a never ending loop. I will have to manually kill snort as webadmin is not doing anything to it.
2010:06:02-15:25:17 gatekeeper snort[8453]: WARNING: Invalid content option in shared object rule: gid:3, sid:15387 : Fast pattern only contents cannot be relative or have non-zero offset/depth content modifiers. Rule will not be registered.
2010:06:02-15:25:17 gatekeeper snort[8453]: WARNING: gid:3, sid:16418. Fast pattern "only" flag used in combination with a fast pattern offset,length - honoring "only" flag and ignoring fast pattern offset,length
Same here. Get the same message as Billybob. Seems to kill almost all network connectivity and no notification email or log entry is generated to give a clue as to which rule/s are at fault.
[QUOTE=Billybob;146243]My IPS is not even initializing correctly. Its stuck in a never ending loop. I will have to manually kill snort as webadmin is not doing anything to it.
2010:06:02-15:25:17 gatekeeper snort[8453]: WARNING: Invalid content option in shared object rule: gid:3, sid:15387 : Fast pattern only contents cannot be relative or have non-zero offset/depth content modifiers. Rule will not be registered.
2010:06:02-15:25:17 gatekeeper snort[8453]: WARNING: gid:3, sid:16418. Fast pattern "only" flag used in combination with a fast pattern offset,length - honoring "only" flag and ignoring fast pattern offset,length
[/QUOTE
seeing the same in my ips log. even if I disable all the IPS attack patterns with ips still enabled, dashboard claims Intrusion Prevention is active with 436 of 8284 patterns and no internet access available.
same here, after update from 7.912 to 7.920 IPS did not start correctly and no internet connection anymore with activated IPS.
]: WARNING: gid:3, sid:13888. Fast pattern "only" flag used in combination with a fast pattern offset,length - honoring "only" flag and ignoring fast pattern offset,length.
