Error With Flowbit dce.bind.netware_cs

The latest registered users rule pack
(snortrules-snapshot-CURRENT.tar.gz), released 2006-12-15, appears to
contain an error.  Sid 4583 that sets the flowbit: dce.bind.netware_cs
has been disabled (commented out) while a number of rules that are
dependant on the flowbit remain enabled by default.

Is there a reason why sid 4583 is no longer on by default?  If the
signature is no longer needed, then the other rules with the
dce.bind.netware_cs dependancy should be disabled by default too. It
is my understanding the only negative effect this error will cause is
a slightly slow initial load time of snort and some unrequired memory
use. This of course assumes that those rules are meant to be
depreciated.

Bammkkkk



--
sguil - The Analyst Console for NSM
http://sguil.sf.net

sig_4583_errors.txt
Description: Text document

_______________________________________________
Bleeding-sigs mailing list
Bleeding-sigs-WwB1pFISwSkm7effSn6vN9HuzzzSOjJt@xxxxxxxxxxxxxxxx
http://lists.bleedingthreats.net/cgi-bin/mailman/listinfo/bleeding-sigs