jrivett

Wrong file names?

3 posts in this topic

I'm at this step: 'Configuring Snort, the Heart of the Windows Intrusion Detection System (WinIDS)'.

At this point there are two commands, the point of which seems to be to clear the blacklist and whitelist files that are included with Snort. Here's the first one:

'type NUL > d:\winids\snort\rules\black_list.rules'

This actually creates a *new* file called 'black_list.rules', with no content (size zero).

I think perhaps the intention was to clear the contents of the existing file, which is actually named 'blacklist.rules'.

I don't see 'white_list.rules' or 'whitelist.rules', so the other command just creates an empty 'white_list.rules'.

Share this post


Link to post
Share on other sites

That is correct. Those two files are used by the Reputation preprocessor. Both files needs to exist or there will be a fatal error.

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now