tweak READMEs

diff --git a/README b/README
index 9739ad7741f51a59f3abb40715b7f1bda71a05d7..f80823b175075e46908de751036e96f5b0d9efd7 100644 (file)
--- a/README
+++ b/README
@@ -65,9 +65,7 @@ the latest:
 
 DOWNLOAD
 
-There are two sets of source tarballs, once for autotools and one for
-cmake.  snort-3 contains the base program and snort_extra has example
-plugins.
+There are two source tarballs, once for autotools and one for cmake:
 
     snort-3.0.0-a1-130-auto.tar.gz
     snort-3.0.0-a1-130-cmake.tar.gz
@@ -117,10 +115,11 @@ Snort++ provides lots of help from the command line.  Here are some examples:
     $my_path/bin/snort --help-module suppress
     $my_path/bin/snort --help-config | grep thread
 
-Examine and dump a pcap:
+Examine and dump a pcap.  In the following, replace a.pcap with your
+favorite:
 
-    $my_path/bin/snort -r pcap
-    $my_path/bin/snort -K text -d -e -q -r pcap
+    $my_path/bin/snort -r a.pcap
+    $my_path/bin/snort -K text -d -e -q -r a.pcap
 
 Verify a config, with or w/o rules:
 
@@ -128,8 +127,8 @@ Verify a config, with or w/o rules:
     $my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules
 
 
-Run IDS mode.  In the following, replace a.pcap with your favorite.  pcaps/
-is a directory with one or more *.pcap files:
+Run IDS mode.  In the following, replace pcaps/ with a path to a directory
+with one or more *.pcap files:
 
     $my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \
         -r a.pcap -A alert_test -n 100000

diff --git a/doc/Makefile.am b/doc/Makefile.am
index 7dddce7386a945907bb19cf71d4e4cc8f2cd3560..708da7c63f6a6a852612af885739e9f76a8e1dd6 100644 (file)
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -158,6 +158,7 @@ html_args = \
 if MAKE_HTML_DOC
 # FIXIT no fuschia for visited; all should be sans serif
 # extracted asciidoc.css doesn't seem to work with -a linkcss
+# asciidoc native html generation; buggy passthru of base64 data
 snort_manual.html: $(all_sources)
        asciidoc -b xhtml11 -a toc2 -a icons -a imagesdir=. $<
        a2x -f chunked $(html_args) $<

diff --git a/doc/snort_manual.txt b/doc/snort_manual.txt
index ed12f7524045e88796f732ef011732356c37e543..dc645de0f3c181686f05628cb211f0d3cfc5f06c 100644 (file)
--- a/doc/snort_manual.txt
+++ b/doc/snort_manual.txt
@@ -5,9 +5,7 @@
 :toc-title: Contents
 
 image::snorty.png["Snorty",width="480"]
-
 include::version.txt[]
-
 toc::[]
 
 == Overview

diff --git a/extra/README b/extra/README
index 391fd42566207722d25f2d39513bd6a5743a2210..56a3843ab7646ed00eb31b6b987697cd89d3709a 100644 (file)
--- a/extra/README
+++ b/extra/README
@@ -55,20 +55,22 @@ To build with cmake, do the following:
 
 RUN EXTRAS
 
+In the following, replace a.pcap with your favorite.
+
 The following demonstrates a C++ logger and a LuaJIT logger:
 
     $my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \
-        -r pcap --plugin-path $my_path/lib/snort_extra -A alert_ex
+        -r a.pcap --plugin-path $my_path/lib/snort_extra -A alert_ex
 
     $my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \
-        -r pcap --script-path $my_path/lib/snort_extra -A lualert
+        -r a.pcap --script-path $my_path/lib/snort_extra -A lualert
 
 You can edit $my_path/lib/snort_extra/loggers/alert.lua to tweak the output format and rerun the above command to try it out.
 
 The last example demonstrates a LuaJIT rule option called find.  The rule, supplied on stdin, uses the Lua [[ multiline string ]] delimiters to avoid shell escape issues:
 
     echo 'alert tcp any any -> any 80 ( sid:1; msg:"test"; http_method; find:"pat = [[GET]]"; )' | \
-        $my_path/bin/snort -c $my_path/etc/snort/snort.lua -r pcap \
+        $my_path/bin/snort -c $my_path/etc/snort/snort.lua -r a.pcap \
             -A cmg --script-path $my_path/lib/snort_extra --stdin-rules
 
 NEXT STEPS o")~