Snort Cookbook
by Angela Orebaugh, Simon Biles & Jacob Babbin

The unconfirmed error reports are from readers.  They have not yet been 
approved or disproved by the author or editor and represent solely the
opinion of the reader.

Here's a key to the markup:
        [page-number]: serious technical mistake
        {page-number}: minor technical mistake
        <page-number>: important language/formatting problem
        (page-number): language change or minor formatting problem
        ?page-number?: reader question or request for clarification

This page was updated May 12, 2005.


UNCONFIRMED  errors and comments from readers: 


[20, 21]  Figure 1-11;

There is an apparent mismatch between Pages 20 and 21.

Page 20 contains an extensive discussion of the wiring shown in Figure 1-11 on Page
21.  The second step of the discussion specifies a numbering scheme for each pin of
the Ethernet jacks shown in the figure.  The discussion describes pin numbering for
each jack of 1, 2, 3, 4, 5, 6, 7, and 8.  Figure 1-11, however, shows pin numbering
of 2, 1, 3, 5, 4, 6, 8, and 7 for each jack.

The wiring shown in the figure does match the text, based on physical position, if
you mentally substitute the pin numbers.


(235)  first paragraph under Solution;
If you want to reset any illegitimate connection attempts, use the resp keyword
from Recipe 2.n.

should read:

If you want to reset any illegitimate connection attempts, use the resp keyword
from Recipe 2.27.


(235)  second paragraph under Solution;
If you want to call on an external program to perform some action, use the
unixsock output plug-in from Recipe 2.n.

should read:

If you want to call on an external program to perform some action, use the
unixsock output plug-in from Recipe 2.23.

(235)  second paragraph under Solution;
unixsock
should read:
alert_unixsock

and should be constant-width like "resp" in the previous paragraph.


(257-258)  sample report;
The report looks like it's supposed to be padded in order to be fully-justified, but
the right column of # characters is ragged, as though the whitespace characters
weren't constant-width.  Perhaps there's a mix of tabs, and tabs on the source system
weren't the same size as tabs on the typesetting system?