Problems with Custom Signatures if you choose the wrong description

[pheuch]

Today I got a problem with a custom signature, I added with .SigWizMenu on a 3.x IDS. I choosed the description

IP Protocoll 77

This caused an error, because the word Protocoll is a keyword in the etc/SigUser.conf file. It caused an error within SigWizMenu and within packetd.conf at sensor restart. It looks like that any keyword which is used in the SigUser.conf file will cause problems.

[jsivulka]

The best place for information related to adding custom signature is http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids6/13346_01.htm. Hope you find the information there.

[marcabal]

In version 3.x you can not use keywords as data in other fields. This problem is fixed in the version 4.x sensors.

If you need to remove the Protocol word from your description you can directly edit the configuration files (either SigSettings.conf or SigUser.conf) to remove that word from the description field. Then nrstop and nrstart to have packetd read in the corrected configuration.