--- /dev/null
+#etc/snort
+#etc/snort/docs
+#etc/snort/docs/100000100.txt
+#etc/snort/docs/100000101.txt
+#etc/snort/docs/100000102.txt
+#etc/snort/docs/100000103.txt
+#etc/snort/docs/100000104.txt
+#etc/snort/docs/100000105.txt
+#etc/snort/docs/100000106.txt
+#etc/snort/docs/100000107.txt
+#etc/snort/docs/100000108.txt
+#etc/snort/docs/100000109.txt
+#etc/snort/docs/100000110.txt
+#etc/snort/docs/100000111.txt
+#etc/snort/docs/100000112.txt
+#etc/snort/docs/100000113.txt
+#etc/snort/docs/100000114.txt
+#etc/snort/docs/100000115.txt
+#etc/snort/docs/100000116.txt
+#etc/snort/docs/100000117.txt
+#etc/snort/docs/100000118.txt
+#etc/snort/docs/100000119.txt
+#etc/snort/docs/100000121.txt
+#etc/snort/docs/100000122.txt
+#etc/snort/docs/100000123.txt
+#etc/snort/docs/100000124.txt
+#etc/snort/docs/100000125.txt
+#etc/snort/docs/100000126.txt
+#etc/snort/docs/100000127.txt
+#etc/snort/docs/100000128.txt
+#etc/snort/docs/100000129.txt
+#etc/snort/docs/100000130.txt
+#etc/snort/docs/100000131.txt
+#etc/snort/docs/100000132.txt
+#etc/snort/docs/100000133.txt
+#etc/snort/docs/100000134.txt
+#etc/snort/docs/100000135.txt
+#etc/snort/docs/100000136.txt
+#etc/snort/docs/100000138.txt
+#etc/snort/docs/100000139.txt
+#etc/snort/docs/100000140.txt
+#etc/snort/docs/100000141.txt
+#etc/snort/docs/100000142.txt
+#etc/snort/docs/100000143.txt
+#etc/snort/docs/100000144.txt
+#etc/snort/docs/100000145.txt
+#etc/snort/docs/100000146.txt
+#etc/snort/docs/100000148.txt
+#etc/snort/docs/100000152.txt
+#etc/snort/docs/100000153.txt
+#etc/snort/docs/100000154.txt
+#etc/snort/docs/100000155.txt
+#etc/snort/docs/100000158.txt
+#etc/snort/docs/100000159.txt
+#etc/snort/docs/100000160.txt
+#etc/snort/docs/100000161.txt
+#etc/snort/docs/100000162.txt
+#etc/snort/docs/100000163.txt
+#etc/snort/docs/100000164.txt
+#etc/snort/docs/100000165.txt
+#etc/snort/docs/100000166.txt
+#etc/snort/docs/100000167.txt
+#etc/snort/docs/100000168.txt
+#etc/snort/docs/100000169.txt
+#etc/snort/docs/100000170.txt
+#etc/snort/docs/100000171.txt
+#etc/snort/docs/100000172.txt
+#etc/snort/docs/100000173.txt
+#etc/snort/docs/100000174.txt
+#etc/snort/docs/100000175.txt
+#etc/snort/docs/100000176.txt
+#etc/snort/docs/100000177.txt
+#etc/snort/docs/100000178.txt
+#etc/snort/docs/100000179.txt
+#etc/snort/docs/100000226.txt
+#etc/snort/docs/100000315.txt
+#etc/snort/docs/100000316.txt
+#etc/snort/docs/100000317.txt
+#etc/snort/docs/100000318.txt
+#etc/snort/docs/100000319.txt
+#etc/snort/docs/100000320.txt
+#etc/snort/docs/100000321.txt
+#etc/snort/docs/100000322.txt
+#etc/snort/docs/100000323.txt
+#etc/snort/docs/100000324.txt
+#etc/snort/docs/100000325.txt
+#etc/snort/docs/100000326.txt
+#etc/snort/docs/100000327.txt
+#etc/snort/docs/100000328.txt
+#etc/snort/docs/100000329.txt
+#etc/snort/docs/100000330.txt
+#etc/snort/docs/100000331.txt
+#etc/snort/docs/100000332.txt
+#etc/snort/docs/100000333.txt
+#etc/snort/docs/100000334.txt
+#etc/snort/docs/100000335.txt
+#etc/snort/docs/100000336.txt
+#etc/snort/docs/100000337.txt
+#etc/snort/docs/100000338.txt
+#etc/snort/docs/100000339.txt
+#etc/snort/docs/100000340.txt
+#etc/snort/docs/100000341.txt
+#etc/snort/docs/100000342.txt
+#etc/snort/docs/100000343.txt
+#etc/snort/docs/100000344.txt
+#etc/snort/docs/100000345.txt
+#etc/snort/docs/100000346.txt
+#etc/snort/docs/100000347.txt
+#etc/snort/docs/100000348.txt
+#etc/snort/docs/100000349.txt
+#etc/snort/docs/100000350.txt
+#etc/snort/docs/100000351.txt
+#etc/snort/docs/100000352.txt
+#etc/snort/docs/100000353.txt
+#etc/snort/docs/100000354.txt
+#etc/snort/docs/100000355.txt
+#etc/snort/docs/100000356.txt
+#etc/snort/docs/100000357.txt
+#etc/snort/docs/100000358.txt
+#etc/snort/docs/100000359.txt
+#etc/snort/docs/100000360.txt
+#etc/snort/docs/100000361.txt
+#etc/snort/docs/100000362.txt
+#etc/snort/docs/100000363.txt
+#etc/snort/docs/100000364.txt
+#etc/snort/docs/100000365.txt
+#etc/snort/docs/100000366.txt
+#etc/snort/docs/100000367.txt
+#etc/snort/docs/100000368.txt
+#etc/snort/docs/100000369.txt
+#etc/snort/docs/100000370.txt
+#etc/snort/docs/100000371.txt
+#etc/snort/docs/100000372.txt
+#etc/snort/docs/100000373.txt
+#etc/snort/docs/100000374.txt
+#etc/snort/docs/100000375.txt
+#etc/snort/docs/100000376.txt
+#etc/snort/docs/100000377.txt
+#etc/snort/docs/100000378.txt
+#etc/snort/docs/100000379.txt
+#etc/snort/docs/100000380.txt
+#etc/snort/docs/100000381.txt
+#etc/snort/docs/100000382.txt
+#etc/snort/docs/100000383.txt
+#etc/snort/docs/100000384.txt
+#etc/snort/docs/100000385.txt
+#etc/snort/docs/100000386.txt
+#etc/snort/docs/100000387.txt
+#etc/snort/docs/100000388.txt
+#etc/snort/docs/100000389.txt
+#etc/snort/docs/100000390.txt
+#etc/snort/docs/100000391.txt
+#etc/snort/docs/100000392.txt
+#etc/snort/docs/100000393.txt
+#etc/snort/docs/100000394.txt
+#etc/snort/docs/100000395.txt
+#etc/snort/docs/100000396.txt
+#etc/snort/docs/100000397.txt
+#etc/snort/docs/100000398.txt
+#etc/snort/docs/100000399.txt
+#etc/snort/docs/100000400.txt
+#etc/snort/docs/100000401.txt
+#etc/snort/docs/100000402.txt
+#etc/snort/docs/100000403.txt
+#etc/snort/docs/100000404.txt
+#etc/snort/docs/100000405.txt
+#etc/snort/docs/100000406.txt
+#etc/snort/docs/100000407.txt
+#etc/snort/docs/100000408.txt
+#etc/snort/docs/100000409.txt
+#etc/snort/docs/100000410.txt
+#etc/snort/docs/100000411.txt
+#etc/snort/docs/100000412.txt
+#etc/snort/docs/100000413.txt
+#etc/snort/docs/100000414.txt
+#etc/snort/docs/100000415.txt
+#etc/snort/docs/100000416.txt
+#etc/snort/docs/100000417.txt
+#etc/snort/docs/100000418.txt
+#etc/snort/docs/100000419.txt
+#etc/snort/docs/100000420.txt
+#etc/snort/docs/100000421.txt
+#etc/snort/docs/100000422.txt
+#etc/snort/docs/100000423.txt
+#etc/snort/docs/100000424.txt
+#etc/snort/docs/100000425.txt
+#etc/snort/docs/100000426.txt
+#etc/snort/docs/100000430.txt
+#etc/snort/docs/100000431.txt
+#etc/snort/docs/100000432.txt
+#etc/snort/docs/100000433.txt
+#etc/snort/docs/100000434.txt
+#etc/snort/docs/100000435.txt
+#etc/snort/docs/100000436.txt
+#etc/snort/docs/100000437.txt
+#etc/snort/docs/100000438.txt
+#etc/snort/docs/100000439.txt
+#etc/snort/docs/100000440.txt
+#etc/snort/docs/100000441.txt
+#etc/snort/docs/100000442.txt
+#etc/snort/docs/100000443.txt
+#etc/snort/docs/100000444.txt
+#etc/snort/docs/100000445.txt
+#etc/snort/docs/100000446.txt
+#etc/snort/docs/100000448.txt
+#etc/snort/docs/100000449.txt
+#etc/snort/docs/100000450.txt
+#etc/snort/docs/100000451.txt
+#etc/snort/docs/100000452.txt
+#etc/snort/docs/100000453.txt
+#etc/snort/docs/100000454.txt
+#etc/snort/docs/100000455.txt
+#etc/snort/docs/100000456.txt
+#etc/snort/docs/100000457.txt
+#etc/snort/docs/100000458.txt
+#etc/snort/docs/100000459.txt
+#etc/snort/docs/100000461.txt
+#etc/snort/docs/100000462.txt
+#etc/snort/docs/100000463.txt
+#etc/snort/docs/100000464.txt
+#etc/snort/docs/100000465.txt
+#etc/snort/docs/100000466.txt
+#etc/snort/docs/100000467.txt
+#etc/snort/docs/100000468.txt
+#etc/snort/docs/100000469.txt
+#etc/snort/docs/100000470.txt
+#etc/snort/docs/100000471.txt
+#etc/snort/docs/100000472.txt
+#etc/snort/docs/100000473.txt
+#etc/snort/docs/100000474.txt
+#etc/snort/docs/100000475.txt
+#etc/snort/docs/100000476.txt
+#etc/snort/docs/100000477.txt
+#etc/snort/docs/100000478.txt
+#etc/snort/docs/100000479.txt
+#etc/snort/docs/100000480.txt
+#etc/snort/docs/100000481.txt
+#etc/snort/docs/100000482.txt
+#etc/snort/docs/100000483.txt
+#etc/snort/docs/100000484.txt
+#etc/snort/docs/100000485.txt
+#etc/snort/docs/100000486.txt
+#etc/snort/docs/100000487.txt
+#etc/snort/docs/100000488.txt
+#etc/snort/docs/100000489.txt
+#etc/snort/docs/100000490.txt
+#etc/snort/docs/100000491.txt
+#etc/snort/docs/100000492.txt
+#etc/snort/docs/100000493.txt
+#etc/snort/docs/100000494.txt
+#etc/snort/docs/100000495.txt
+#etc/snort/docs/100000496.txt
+#etc/snort/docs/100000497.txt
+#etc/snort/docs/100000498.txt
+#etc/snort/docs/100000499.txt
+#etc/snort/docs/100000500.txt
+#etc/snort/docs/100000501.txt
+#etc/snort/docs/100000502.txt
+#etc/snort/docs/100000503.txt
+#etc/snort/docs/100000504.txt
+#etc/snort/docs/100000505.txt
+#etc/snort/docs/100000506.txt
+#etc/snort/docs/100000507.txt
+#etc/snort/docs/100000508.txt
+#etc/snort/docs/100000509.txt
+#etc/snort/docs/100000510.txt
+#etc/snort/docs/100000511.txt
+#etc/snort/docs/100000512.txt
+#etc/snort/docs/100000513.txt
+#etc/snort/docs/100000514.txt
+#etc/snort/docs/100000515.txt
+#etc/snort/docs/100000516.txt
+#etc/snort/docs/100000517.txt
+#etc/snort/docs/100000518.txt
+#etc/snort/docs/100000519.txt
+#etc/snort/docs/100000520.txt
+#etc/snort/docs/100000521.txt
+#etc/snort/docs/100000522.txt
+#etc/snort/docs/100000523.txt
+#etc/snort/docs/100000524.txt
+#etc/snort/docs/100000525.txt
+#etc/snort/docs/100000526.txt
+#etc/snort/docs/100000527.txt
+#etc/snort/docs/100000528.txt
+#etc/snort/docs/100000529.txt
+#etc/snort/docs/100000530.txt
+#etc/snort/docs/100000531.txt
+#etc/snort/docs/100000532.txt
+#etc/snort/docs/100000533.txt
+#etc/snort/docs/100000534.txt
+#etc/snort/docs/100000535.txt
+#etc/snort/docs/100000536.txt
+#etc/snort/docs/100000537.txt
+#etc/snort/docs/100000538.txt
+#etc/snort/docs/100000539.txt
+#etc/snort/docs/100000540.txt
+#etc/snort/docs/100000541.txt
+#etc/snort/docs/100000542.txt
+#etc/snort/docs/100000543.txt
+#etc/snort/docs/100000544.txt
+#etc/snort/docs/100000545.txt
+#etc/snort/docs/100000546.txt
+#etc/snort/docs/100000547.txt
+#etc/snort/docs/100000548.txt
+#etc/snort/docs/100000549.txt
+#etc/snort/docs/100000550.txt
+#etc/snort/docs/100000551.txt
+#etc/snort/docs/100000552.txt
+#etc/snort/docs/100000553.txt
+#etc/snort/docs/100000554.txt
+#etc/snort/docs/100000555.txt
+#etc/snort/docs/100000556.txt
+#etc/snort/docs/100000557.txt
+#etc/snort/docs/100000558.txt
+#etc/snort/docs/100000559.txt
+#etc/snort/docs/100000560.txt
+#etc/snort/docs/100000561.txt
+#etc/snort/docs/100000562.txt
+#etc/snort/docs/100000563.txt
+#etc/snort/docs/100000564.txt
+#etc/snort/docs/100000565.txt
+#etc/snort/docs/100000566.txt
+#etc/snort/docs/100000567.txt
+#etc/snort/docs/100000568.txt
+#etc/snort/docs/100000569.txt
+#etc/snort/docs/100000570.txt
+#etc/snort/docs/100000571.txt
+#etc/snort/docs/100000572.txt
+#etc/snort/docs/100000573.txt
+#etc/snort/docs/100000574.txt
+#etc/snort/docs/100000575.txt
+#etc/snort/docs/100000576.txt
+#etc/snort/docs/100000577.txt
+#etc/snort/docs/100000578.txt
+#etc/snort/docs/100000579.txt
+#etc/snort/docs/100000580.txt
+#etc/snort/docs/100000581.txt
+#etc/snort/docs/100000582.txt
+#etc/snort/docs/100000583.txt
+#etc/snort/docs/100000584.txt
+#etc/snort/docs/100000585.txt
+#etc/snort/docs/100000586.txt
+#etc/snort/docs/100000587.txt
+#etc/snort/docs/100000588.txt
+#etc/snort/docs/100000589.txt
+#etc/snort/docs/100000590.txt
+#etc/snort/docs/100000591.txt
+#etc/snort/docs/100000592.txt
+#etc/snort/docs/100000593.txt
+#etc/snort/docs/100000594.txt
+#etc/snort/docs/100000595.txt
+#etc/snort/docs/100000596.txt
+#etc/snort/docs/100000597.txt
+#etc/snort/docs/100000598.txt
+#etc/snort/docs/100000599.txt
+#etc/snort/docs/100000600.txt
+#etc/snort/docs/100000601.txt
+#etc/snort/docs/100000602.txt
+#etc/snort/docs/100000603.txt
+#etc/snort/docs/100000604.txt
+#etc/snort/docs/100000605.txt
+#etc/snort/docs/100000606.txt
+#etc/snort/docs/100000607.txt
+#etc/snort/docs/100000608.txt
+#etc/snort/docs/100000609.txt
+#etc/snort/docs/100000610.txt
+#etc/snort/docs/100000611.txt
+#etc/snort/docs/100000612.txt
+#etc/snort/docs/100000613.txt
+#etc/snort/docs/100000614.txt
+#etc/snort/docs/100000615.txt
+#etc/snort/docs/100000616.txt
+#etc/snort/docs/100000617.txt
+#etc/snort/docs/100000618.txt
+#etc/snort/docs/100000619.txt
+#etc/snort/docs/100000620.txt
+#etc/snort/docs/100000621.txt
+#etc/snort/docs/100000622.txt
+#etc/snort/docs/100000623.txt
+#etc/snort/docs/100000624.txt
+#etc/snort/docs/100000625.txt
+#etc/snort/docs/100000626.txt
+#etc/snort/docs/100000627.txt
+#etc/snort/docs/100000628.txt
+#etc/snort/docs/100000629.txt
+#etc/snort/docs/100000630.txt
+#etc/snort/docs/100000631.txt
+#etc/snort/docs/100000632.txt
+#etc/snort/docs/100000633.txt
+#etc/snort/docs/100000634.txt
+#etc/snort/docs/100000635.txt
+#etc/snort/docs/100000636.txt
+#etc/snort/docs/100000637.txt
+#etc/snort/docs/100000638.txt
+#etc/snort/docs/100000639.txt
+#etc/snort/docs/100000640.txt
+#etc/snort/docs/100000641.txt
+#etc/snort/docs/100000642.txt
+#etc/snort/docs/100000643.txt
+#etc/snort/docs/100000644.txt
+#etc/snort/docs/100000645.txt
+#etc/snort/docs/100000646.txt
+#etc/snort/docs/100000647.txt
+#etc/snort/docs/100000648.txt
+#etc/snort/docs/100000649.txt
+#etc/snort/docs/100000650.txt
+#etc/snort/docs/100000651.txt
+#etc/snort/docs/100000652.txt
+#etc/snort/docs/100000653.txt
+#etc/snort/docs/100000654.txt
+#etc/snort/docs/100000655.txt
+#etc/snort/docs/100000656.txt
+#etc/snort/docs/100000657.txt
+#etc/snort/docs/100000658.txt
+#etc/snort/docs/100000659.txt
+#etc/snort/docs/100000660.txt
+#etc/snort/docs/100000661.txt
+#etc/snort/docs/100000662.txt
+#etc/snort/docs/100000663.txt
+#etc/snort/docs/100000664.txt
+#etc/snort/docs/100000665.txt
+#etc/snort/docs/100000666.txt
+#etc/snort/docs/100000667.txt
+#etc/snort/docs/100000668.txt
+#etc/snort/docs/100000669.txt
+#etc/snort/docs/100000670.txt
+#etc/snort/docs/100000671.txt
+#etc/snort/docs/100000672.txt
+#etc/snort/docs/100000673.txt
+#etc/snort/docs/100000674.txt
+#etc/snort/docs/100000675.txt
+#etc/snort/docs/100000676.txt
+#etc/snort/docs/100000677.txt
+#etc/snort/docs/100000678.txt
+#etc/snort/docs/100000679.txt
+#etc/snort/docs/100000680.txt
+#etc/snort/docs/100000681.txt
+#etc/snort/docs/100000682.txt
+#etc/snort/docs/100000683.txt
+#etc/snort/docs/100000686.txt
+#etc/snort/docs/100000687.txt
+#etc/snort/docs/100000690.txt
+#etc/snort/docs/100000691.txt
+#etc/snort/docs/100000694.txt
+#etc/snort/docs/100000695.txt
+#etc/snort/docs/100000696.txt
+#etc/snort/docs/100000697.txt
+#etc/snort/docs/100000698.txt
+#etc/snort/docs/100000699.txt
+#etc/snort/docs/100000700.txt
+#etc/snort/docs/100000701.txt
+#etc/snort/docs/100000702.txt
+#etc/snort/docs/100000704.txt
+#etc/snort/docs/100000705.txt
+#etc/snort/docs/100000706.txt
+#etc/snort/docs/100000707.txt
+#etc/snort/docs/100000708.txt
+#etc/snort/docs/100000709.txt
+#etc/snort/docs/100000710.txt
+#etc/snort/docs/100000711.txt
+#etc/snort/docs/100000712.txt
+#etc/snort/docs/100000713.txt
+#etc/snort/docs/100000714.txt
+#etc/snort/docs/100000715.txt
+#etc/snort/docs/100000716.txt
+#etc/snort/docs/100000717.txt
+#etc/snort/docs/100000718.txt
+#etc/snort/docs/100000719.txt
+#etc/snort/docs/100000720.txt
+#etc/snort/docs/100000721.txt
+#etc/snort/docs/100000722.txt
+#etc/snort/docs/100000723.txt
+#etc/snort/docs/100000724.txt
+#etc/snort/docs/100000725.txt
+#etc/snort/docs/100000726.txt
+#etc/snort/docs/100000727.txt
+#etc/snort/docs/100000728.txt
+#etc/snort/docs/100000729.txt
+#etc/snort/docs/100000730.txt
+#etc/snort/docs/100000731.txt
+#etc/snort/docs/100000732.txt
+#etc/snort/docs/100000733.txt
+#etc/snort/docs/100000734.txt
+#etc/snort/docs/100000735.txt
+#etc/snort/docs/100000736.txt
+#etc/snort/docs/100000737.txt
+#etc/snort/docs/100000738.txt
+#etc/snort/docs/100000739.txt
+#etc/snort/docs/100000740.txt
+#etc/snort/docs/100000741.txt
+#etc/snort/docs/100000742.txt
+#etc/snort/docs/100000743.txt
+#etc/snort/docs/100000744.txt
+#etc/snort/docs/100000745.txt
+#etc/snort/docs/100000746.txt
+#etc/snort/docs/100000747.txt
+#etc/snort/docs/100000748.txt
+#etc/snort/docs/100000749.txt
+#etc/snort/docs/100000750.txt
+#etc/snort/docs/100000751.txt
+#etc/snort/docs/100000752.txt
+#etc/snort/docs/100000753.txt
+#etc/snort/docs/100000754.txt
+#etc/snort/docs/100000755.txt
+#etc/snort/docs/100000756.txt
+#etc/snort/docs/100000757.txt
+#etc/snort/docs/100000758.txt
+#etc/snort/docs/100000759.txt
+#etc/snort/docs/100000760.txt
+#etc/snort/docs/100000761.txt
+#etc/snort/docs/100000762.txt
+#etc/snort/docs/100000763.txt
+#etc/snort/docs/100000764.txt
+#etc/snort/docs/100000765.txt
+#etc/snort/docs/100000766.txt
+#etc/snort/docs/100000767.txt
+#etc/snort/docs/100000768.txt
+#etc/snort/docs/100000769.txt
+#etc/snort/docs/100000770.txt
+#etc/snort/docs/100000771.txt
+#etc/snort/docs/100000772.txt
+#etc/snort/docs/100000773.txt
+#etc/snort/docs/100000774.txt
+#etc/snort/docs/100000775.txt
+#etc/snort/docs/100000776.txt
+#etc/snort/docs/100000777.txt
+#etc/snort/docs/100000778.txt
+#etc/snort/docs/100000779.txt
+#etc/snort/docs/100000780.txt
+#etc/snort/docs/100000781.txt
+#etc/snort/docs/100000782.txt
+#etc/snort/docs/100000783.txt
+#etc/snort/docs/100000784.txt
+#etc/snort/docs/100000785.txt
+#etc/snort/docs/100000786.txt
+#etc/snort/docs/100000787.txt
+#etc/snort/docs/100000788.txt
+#etc/snort/docs/100000789.txt
+#etc/snort/docs/100000790.txt
+#etc/snort/docs/100000791.txt
+#etc/snort/docs/100000792.txt
+#etc/snort/docs/100000793.txt
+#etc/snort/docs/100000794.txt
+#etc/snort/docs/100000795.txt
+#etc/snort/docs/100000796.txt
+#etc/snort/docs/100000797.txt
+#etc/snort/docs/100000798.txt
+#etc/snort/docs/100000799.txt
+#etc/snort/docs/100000800.txt
+#etc/snort/docs/100000801.txt
+#etc/snort/docs/100000802.txt
+#etc/snort/docs/100000803.txt
+#etc/snort/docs/100000804.txt
+#etc/snort/docs/100000805.txt
+#etc/snort/docs/100000806.txt
+#etc/snort/docs/100000807.txt
+#etc/snort/docs/100000808.txt
+#etc/snort/docs/100000809.txt
+#etc/snort/docs/100000810.txt
+#etc/snort/docs/100000811.txt
+#etc/snort/docs/100000812.txt
+#etc/snort/docs/100000813.txt
+#etc/snort/docs/100000814.txt
+#etc/snort/docs/100000815.txt
+#etc/snort/docs/100000816.txt
+#etc/snort/docs/100000817.txt
+#etc/snort/docs/100000818.txt
+#etc/snort/docs/100000820.txt
+#etc/snort/docs/100000821.txt
+#etc/snort/docs/100000822.txt
+#etc/snort/docs/100000823.txt
+#etc/snort/docs/100000824.txt
+#etc/snort/docs/100000825.txt
+#etc/snort/docs/100000826.txt
+#etc/snort/docs/100000827.txt
+#etc/snort/docs/100000828.txt
+#etc/snort/docs/100000829.txt
+#etc/snort/docs/100000830.txt
+#etc/snort/docs/100000831.txt
+#etc/snort/docs/100000832.txt
+#etc/snort/docs/100000833.txt
+#etc/snort/docs/100000834.txt
+#etc/snort/docs/100000835.txt
+#etc/snort/docs/100000836.txt
+#etc/snort/docs/100000837.txt
+#etc/snort/docs/100000838.txt
+#etc/snort/docs/100000839.txt
+#etc/snort/docs/100000840.txt
+#etc/snort/docs/100000841.txt
+#etc/snort/docs/100000842.txt
+#etc/snort/docs/100000843.txt
+#etc/snort/docs/100000844.txt
+#etc/snort/docs/100000845.txt
+#etc/snort/docs/100000846.txt
+#etc/snort/docs/100000847.txt
+#etc/snort/docs/100000848.txt
+#etc/snort/docs/100000849.txt
+#etc/snort/docs/100000850.txt
+#etc/snort/docs/100000851.txt
+#etc/snort/docs/100000852.txt
+#etc/snort/docs/100000853.txt
+#etc/snort/docs/100000854.txt
+#etc/snort/docs/100000855.txt
+#etc/snort/docs/100000856.txt
+#etc/snort/docs/100000857.txt
+#etc/snort/docs/100000858.txt
+#etc/snort/docs/100000859.txt
+#etc/snort/docs/100000860.txt
+#etc/snort/docs/100000861.txt
+#etc/snort/docs/100000862.txt
+#etc/snort/docs/100000863.txt
+#etc/snort/docs/100000923.txt
+#etc/snort/docs/100000927.txt
+etc/snort/rules
+#etc/snort/rules/LICENSE
+#etc/snort/rules/classification.config
+#etc/snort/rules/community-bot.rules
+#etc/snort/rules/community-deleted.rules
+#etc/snort/rules/community-dos.rules
+#etc/snort/rules/community-exploit.rules
+#etc/snort/rules/community-ftp.rules
+#etc/snort/rules/community-game.rules
+#etc/snort/rules/community-icmp.rules
+#etc/snort/rules/community-imap.rules
+#etc/snort/rules/community-inappropriate.rules
+#etc/snort/rules/community-mail-client.rules
+#etc/snort/rules/community-misc.rules
+#etc/snort/rules/community-nntp.rules
+#etc/snort/rules/community-oracle.rules
+#etc/snort/rules/community-policy.rules
+#etc/snort/rules/community-sid-msg.map
+#etc/snort/rules/community-sip.rules
+#etc/snort/rules/community-smtp.rules
+#etc/snort/rules/community-sql-injection.rules
+#etc/snort/rules/community-virus.rules
+#etc/snort/rules/community-web-attacks.rules
+#etc/snort/rules/community-web-cgi.rules
+#etc/snort/rules/community-web-client.rules
+#etc/snort/rules/community-web-dos.rules
+#etc/snort/rules/community-web-iis.rules
+#etc/snort/rules/community-web-misc.rules
+#etc/snort/rules/community-web-php.rules
+#etc/snort/rules/reference.config
+etc/snort/snort.conf
+etc/snort/unicode.map
+usr/lib/snort_dynamicengine
+#usr/lib/snort_dynamicengine/libsf_engine.a
+#usr/lib/snort_dynamicengine/libsf_engine.la
+#usr/lib/snort_dynamicengine/libsf_engine.so
+#usr/lib/snort_dynamicengine/libsf_engine.so.0
+#usr/lib/snort_dynamicengine/libsf_engine.so.0.0.0
+usr/lib/snort_dynamicpreprocessor
+#usr/lib/snort_dynamicpreprocessor/libsf_dcerpc_preproc.a
+usr/lib/snort_dynamicpreprocessor/libsf_dcerpc_preproc.la
+#usr/lib/snort_dynamicpreprocessor/libsf_dcerpc_preproc.so
+#usr/lib/snort_dynamicpreprocessor/libsf_dcerpc_preproc.so.0
+#usr/lib/snort_dynamicpreprocessor/libsf_dcerpc_preproc.so.0.0.0
+#usr/lib/snort_dynamicpreprocessor/libsf_dns_preproc.a
+#usr/lib/snort_dynamicpreprocessor/libsf_dns_preproc.la
+#usr/lib/snort_dynamicpreprocessor/libsf_dns_preproc.so
+#usr/lib/snort_dynamicpreprocessor/libsf_dns_preproc.so.0
+#usr/lib/snort_dynamicpreprocessor/libsf_dns_preproc.so.0.0.0
+#usr/lib/snort_dynamicpreprocessor/libsf_ftptelnet_preproc.a
+#usr/lib/snort_dynamicpreprocessor/libsf_ftptelnet_preproc.la
+#usr/lib/snort_dynamicpreprocessor/libsf_ftptelnet_preproc.so
+#usr/lib/snort_dynamicpreprocessor/libsf_ftptelnet_preproc.so.0
+#usr/lib/snort_dynamicpreprocessor/libsf_ftptelnet_preproc.so.0.0.0
+#usr/lib/snort_dynamicpreprocessor/libsf_smtp_preproc.a
+#usr/lib/snort_dynamicpreprocessor/libsf_smtp_preproc.la
+#usr/lib/snort_dynamicpreprocessor/libsf_smtp_preproc.so
+#usr/lib/snort_dynamicpreprocessor/libsf_smtp_preproc.so.0
+#usr/lib/snort_dynamicpreprocessor/libsf_smtp_preproc.so.0.0.0
+#usr/lib/snort_dynamicpreprocessor/libsf_ssh_preproc.a
+#usr/lib/snort_dynamicpreprocessor/libsf_ssh_preproc.la
+#usr/lib/snort_dynamicpreprocessor/libsf_ssh_preproc.so
+#usr/lib/snort_dynamicpreprocessor/libsf_ssh_preproc.so.0
+#usr/lib/snort_dynamicpreprocessor/libsf_ssh_preproc.so.0.0.0
+#usr/man/man8/snort.8
+usr/sbin/snort
+var/log/snort
#--------------------------------------------------
-# http://www.snort.org Snort 2.8.3.2 Ruleset
+# http://www.snort.org Snort 2.8.4 Ruleset
# Contact: snort-sigs@lists.sourceforge.net
#--------------------------------------------------
# $Id$
# the form
# preprocessor <name_of_processor>: <configuration_options>
-# Configure Flow tracking module
-# -------------------------------
-#
-# The Flow tracking module is meant to start unifying the state keeping
-# mechanisms of snort into a single place. Right now, only a portscan detector
-# is implemented but in the long term, many of the stateful subsystems of
-# snort will be migrated over to becoming flow plugins. This must be enabled
-# for flow-portscan to work correctly.
-#
-# See README.flow for additional information
-#
-#preprocessor flow: stats_interval 0 hash 2
-
# frag3: Target-based IP defragmentation
# --------------------------------------
#
preprocessor frag3_global: max_frags 65536
preprocessor frag3_engine: policy first detect_anomalies
-
-# stream4: stateful inspection/stream reassembly for Snort
-#----------------------------------------------------------------------
-# Use in concert with the -z [all|est] command line switch to defeat stick/snot
-# against TCP rules. Also performs full TCP stream reassembly, stateful
-# inspection of TCP streams, etc. Can statefully detect various portscan
-# types, fingerprinting, ECN, etc.
-
-# stateful inspection directive
-# no arguments loads the defaults (timeout 30, memcap 8388608)
-# options (options are comma delimited):
-# detect_scans - stream4 will detect stealth portscans and generate alerts
-# when it sees them when this option is set
-# detect_state_problems - detect TCP state problems, this tends to be very
-# noisy because there are a lot of crappy ip stack
-# implementations out there
-#
-# disable_evasion_alerts - turn off the possibly noisy mitigation of
-# overlapping sequences.
-#
-# ttl_limit [number] - differential of the initial ttl on a session versus
-# the normal that someone may be playing games.
-# Routing flap may cause lots of false positives.
-#
-# keepstats [machine|binary] - keep session statistics, add "machine" to
-# get them in a flat format for machine reading, add
-# "binary" to get them in a unified binary output
-# format
-# noinspect - turn off stateful inspection only
-# timeout [number] - set the session timeout counter to [number] seconds,
-# default is 30 seconds
-# max_sessions [number] - limit the number of sessions stream4 keeps
-# track of
-# memcap [number] - limit stream4 memory usage to [number] bytes (does
-# not include session tracking, which is set by the
-# max_sessions option)
-# log_flushed_streams - if an event is detected on a stream this option will
-# cause all packets that are stored in the stream4
-# packet buffers to be flushed to disk. This only
-# works when logging in pcap mode!
-# server_inspect_limit [bytes] - Byte limit on server side inspection.
-# enable_udp_sessions - turn on tracking of "sessions" over UDP. Requires
-# configure --enable-stream4udp. UDP sessions are
-# only created when there is a rule for the sender or
-# responder that has a flow or flowbits keyword.
-# max_udp_sessions [number] - limit the number of simultaneous UDP sessions
-# to track
-# udp_ignore_any - Do not inspect UDP packets unless there is a port specific
-# rule for a given port. This is a performance improvement
-# and turns off inspection for udp xxx any -> xxx any rules
-# cache_clean_sessions [number] - Cleanup the session cache by number sessions
-# at a time. The larger the value, the
-# more sessions are purged from the cache when
-# the session limit or memcap is reached.
-# Defaults to 5.
-#
-#
-#
-# Stream4 uses Generator ID 111 and uses the following SIDS
-# for that GID:
-# SID Event description
-# ----- -------------------
-# 1 Stealth activity
-# 2 Evasive RST packet
-# 3 Evasive TCP packet retransmission
-# 4 TCP Window violation
-# 5 Data on SYN packet
-# 6 Stealth scan: full XMAS
-# 7 Stealth scan: SYN-ACK-PSH-URG
-# 8 Stealth scan: FIN scan
-# 9 Stealth scan: NULL scan
-# 10 Stealth scan: NMAP XMAS scan
-# 11 Stealth scan: Vecna scan
-# 12 Stealth scan: NMAP fingerprint scan stateful detect
-# 13 Stealth scan: SYN-FIN scan
-# 14 TCP forward overlap
-
-#preprocessor stream4: disable_evasion_alerts
-
-# tcp stream reassembly directive
-# no arguments loads the default configuration
-# Only reassemble the client,
-# Only reassemble the default list of ports (See below),
-# Give alerts for "bad" streams
-#
-# Available options (comma delimited):
-# clientonly - reassemble traffic for the client side of a connection only
-# serveronly - reassemble traffic for the server side of a connection only
-# both - reassemble both sides of a session
-# noalerts - turn off alerts from the stream reassembly stage of stream4
-# ports [list] - use the space separated list of ports in [list], "all"
-# will turn on reassembly for all ports, "default" will turn
-# on reassembly for ports 21, 23, 25, 42, 53, 80, 110,
-# 111, 135, 136, 137, 139, 143, 445, 513, 514, 1433, 1521,
-# 2401, and 3306
-# favor_old - favor an old segment (based on sequence number) over a new one.
-# This is the default.
-# favor_new - favor an new segment (based on sequence number) over an old one.
-# overlap_limit [number] - limit on overlaping segments for a session.
-# flush_on_alert - flushes stream when an alert is generated for a session.
-# flush_behavior [mode] -
-# default - use old static flushpoints (default)
-# large_window - use new larger static flushpoints
-# random - use random flushpoints defined by flush_base,
-# flush_seed and flush_range
-# flush_base [number] - lowest allowed random flushpoint (512 by default)
-# flush_range [number] - number is the space within which random flushpoints
-# are generated (default 1213)
-# flush_seed [number] - seed for the random number generator, defaults to
-# Snort PID + time
-#
-# Using the default random flushpoints, the smallest flushpoint is 512,
-# and the largest is 1725 bytes.
-#preprocessor stream4_reassemble
-
# stream5: Target Based stateful inspection/stream reassembly for Snort
# ---------------------------------------------------------------------
-# Stream5 is a target-based stream engine for Snort. Its functionality
-# replaces that of Stream4. Consequently, BOTH Stream4 and Stream5
-# cannot be used simultaneously. Comment out the stream4 configurations
-# above to use Stream5.
+# Stream5 is a target-based stream engine for Snort. It handles both
+# TCP and UDP connection tracking as well as TCP reassembly.
#
# See README.stream5 for details on the configuration options.
#
-# Example config (that emulates Stream4 with UDP support compiled in)
+# Example config
preprocessor stream5_global: max_tcp 8192, track_tcp yes, \
track_udp no
preprocessor stream5_tcp: policy first, use_static_footprint_sizes
# dynamicpreprocessor file <full path to libsf_dcerpc_preproc.so>
# or use commandline option
# --dynamic-preprocessor-lib <full path to libsf_dcerpc_preproc.so>
+#
+#preprocessor dcerpc: \
+# autodetect \
+# max_frag_size 3000 \
+# memcap 100000
+
+
+# DCE/RPC 2
+#----------------------------------------
+# See doc/README.dcerpc2 for explanations of what the
+# preprocessor does and how to configure it.
+#
+preprocessor dcerpc2
+preprocessor dcerpc2_server: default
-preprocessor dcerpc: \
- autodetect \
- max_frag_size 3000 \
- memcap 100000
# DNS
#----------------------------------------
# inspected. Once the traffic is determined to be encrypted, no further
# inspection of the data on the connection is made.
#
-# Important note: Stream4 or Stream5 should be explicitly told to reassemble
+# If you don't necessarily trust all of the SSL capable servers on your
+# network, you should remove the "trustservers" option from the configuration.
+#
+# Important note: Stream5 should be explicitly told to reassemble
# traffic on the ports that you intend to inspect SSL
# encrypted traffic on.
#
# To add reassembly on port 443 to Stream5, use 'port both 443' in the
# Stream5 configuration.
-preprocessor ssl: noinspect_encrypted
+preprocessor ssl: noinspect_encrypted, trustservers
####################################################################
#include $RULE_PATH/ddos.rules
#include $RULE_PATH/dns.rules
#include $RULE_PATH/tftp.rules
-
#include $RULE_PATH/web-cgi.rules
#include $RULE_PATH/web-coldfusion.rules
#include $RULE_PATH/web-iis.rules
#include $RULE_PATH/web-misc.rules
#include $RULE_PATH/web-client.rules
#include $RULE_PATH/web-php.rules
-
#include $RULE_PATH/sql.rules
#include $RULE_PATH/x11.rules
#include $RULE_PATH/icmp.rules
#include $RULE_PATH/oracle.rules
#include $RULE_PATH/mysql.rules
#include $RULE_PATH/snmp.rules
-
#include $RULE_PATH/smtp.rules
#include $RULE_PATH/imap.rules
#include $RULE_PATH/pop2.rules
#include $RULE_PATH/pop3.rules
-
#include $RULE_PATH/nntp.rules
#include $RULE_PATH/other-ids.rules
# include $RULE_PATH/web-attacks.rules
# include $RULE_PATH/spyware-put.rules
# include $RULE_PATH/specific-threats.rules
#include $RULE_PATH/experimental.rules
-
# include $PREPROC_RULE_PATH/preprocessor.rules
# include $PREPROC_RULE_PATH/decoder.rules
projects / ipfire-2.x.git / commitdiff
