Well now, if it happended to work I assumed it was the correct syntax. I
didn't bother to read the manual to notice it wasn't listed... :)
I guess it serves me right for not following the guidelines :)
On Thu, Apr 17, 2008 at 4:52 PM, Peter Haag <[EMAIL PROTECTED]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi Gabor,
>
> - --On April 17, 2008 15:15:46 +0200 "Kiss Gabor (Bitman)" <
> [EMAIL PROTECTED]> wrote:
>
> | Dear Peter,
> |
> | > | File /usr/local/nfsen/profiles/./MTAK-HTTP/c6513-filter.txt contains
> this:
> | > |
> | > | (dstnet 193.224.96.0/24 and dstport 80) or (srcnet 193.224.96.0/24and
> srcport 80)
> | >
> | > There was never a version, which supported that syntax! Which one
> should that be?
> |
> | snapshot-20070312
> | See attached image. It proofs that two weeks ago I did have data. :-)
> | Now I changed the filter and _all_ profiles works again.
> | Never mind.
>
> I checked the snapshot. It did not enforce the space even it was never
> documented as such.
> In the man page all examples and the definition of the syntax itself was
> given by using spaces.
> So you and also Adrian run into an undocumented features, which were never
> intended as such.
>
> |
> | The real problem discovered now is that if one profile filter is bad
> | nfprofile crashes and all profiles silently remain empty.
>
> It exists on wrong filter syntax - it does not crash! :)
>
> exit(254)
> - Peter
>
> |
> | Regards
> |
> | Gabor
>
>
>
> - --
> _______ SWITCH - The Swiss Education and Research Network ______
> Peter Haag, Security Engineer, Member of SWITCH CERT
> PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.3 (Darwin)
>
> iQCVAwUBSAdWPf5AbZRALNr/AQLsxwP+JQUXEVcfeiByzBdRhuBk1DjalDV8cgrY
> bDjmdNacsNnqBrYsFe3im5g4h7A17XDLADOLqmVN6TkYCPPybvVsNQG+O4OM+puI
> i6mbADj1yBQnBEMEQ2ToCdvrnVJ6/RK00ksKYFBLQKEGR0Ekb5W47EaJ9MzTgWOe
> yHb80yQIVnA=
> =AUgc
> -----END PGP SIGNATURE-----
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
> Don't miss this year's exciting event. There's still time to save $100.
> Use priority code J8TL2D2.
>
> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
> _______________________________________________
> Nfsen-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
