<![CDATA[Snort fails to start on rule initialization]]>Not sure if anyone else had this problem with starting snort.

ERROR: /usr/local/etc/snort/rules/ddos.rules(25) => Invalid port: [31335,35555]
Fatal Error, Quitting..

Note that I havn't really gone into much detail yet on the cause of the problem (being related to the rule or snort itself).

In any case, it starts fine if I disable this rule.  Just wanted to put this out there.

I've also disabled the automatic rule updates for the time being.

1.2-RELEASE
built on Sun Feb 24 17:04:58 EST 2008

Snort v2.7.0.1_4

]]>https://forum.netgate.com/topic/8859/snort-fails-to-start-on-rule-initializationRSS for NodeSun, 07 Jun 2026 01:44:01 GMTSun, 11 May 2008 20:18:34 GMT60<![CDATA[Reply to Snort fails to start on rule initialization on Mon, 12 May 2008 02:01:57 GMT]]>I had the same problem, and I've just been running without those rules. I'm guessing that this rule is responsible:

223 udp $EXTERNAL_NET any $HOME_NET [31335,35555] DDOS Trin00 Daemon to Master PONG message detected

Edit: I disabled that rule, and it starts up fine. I guess the syntax on the port specification is incorrect.

]]>https://forum.netgate.com/post/173470https://forum.netgate.com/post/173470Mon, 12 May 2008 02:01:57 GMT