distancewith no prior
offsetand various other incorrect combinations.
I've received a lot of emails since we put out 18.104.22.168 complaining that Snort won't start.
My suggestion is that you start Snort with the
-Tcommand line tag instead of
-Tstarts Snort in test mode. "Test mode" will tell you about any errors in your rules and will not be able to fully complete it's startup test unless everything checks out (including these new checks).
If you maintain a
local.rulesfile or if you receive rules from a secondary repository (other than VRT's feed) you'll want to start your new version of Snort in
-Tmode and correct any errors. (By the way, I'm not picking on any particular external ruleset out there, there are several external rulesets that we know of, and this goes for all of them.)