beta.13 (and beta.12) insect
Eric
eric-list-argus at catastrophe.net
Mon Aug 25 14:14:03 EDT 2003
On Mon, 2003-08-25 at 14:10:08 -0400, Carter Bullard proclaimed...
> Quotes ever get past the shell, unless you escape them so
> tcpdump would barf on this expression as well. put it in parenthesis.
>
> "not (tcp port 80 or (icmp[icmptype]==icmp-echo > && icmp[8:4]==0xAAAAAAAA
> && icmp[12:4]==0xAAAAAAAA))"
still no go
bash-2.05b# argus[88687]: ArgusInputFilter "not (tcp port 80 or
(icmp[icmptype]==icmp-echo > && icmp[8:4]==0xAAAAAAAA &&
icmp[12:4]==0xAAAAAAAA))" syntax error
I'm running beta.12
More information about the argus
mailing list