Most curious...
In this case I can't explain how my scripts managed to work by using inif,
outif for more than a year... Maybe this was actually a bug that was
inadvertently corrected? I no longer have snapshot 200802* to try it out,
but something definitely changed...
On Mon, Apr 14, 2008 at 10:19 AM, Peter Haag <[EMAIL PROTECTED]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi Adrian,
> There is no change in the filter syntax.
>
> - --On April 10, 2008 16:28:22 +0300 Adrian Popa <[EMAIL PROTECTED]>
> wrote:
>
> | Hello everyone,
> |
> | I've just installed nfsen 1.3 on top of a snapshot 200702 version and
> | everything went more or less ok, but I was shocked to see that my custom
> | plugins won't run.
> |
> | Actually, the run just fine, but they don't do usefull things. I ran
> some
> | debugs and I noticed the filter syntax changed slightly, meaning that
> the
> | following are no longer supported:
> | - inif
> | - outif
> | - srcas
> | - dstas
>
> Since ever the correct syntax is:
>
> in if
> out if
> src as
> dst as
>
> The syntax anyway is a question of nfdump and not NfSen.
>
> |
> | The versions with space (in if) work just fine.
> |
> | Peter, why have you chosen to discontinue these filter parameters since
> they
> | worked so well in the previous versions? I've had to hack my modules to
> call
> | the right commands and it wasn't pretty... :)
>
> Sorry Adrian, but I don't understand that at all. The only really change
> in filter syntax was the removal of the no longer
> supported shortcut protocol selector 'tcp' etc. which now needs to be
> written as 'proto tcp'. This was deprecated since 1.5.x
> and announced as such each time this syntax was used.
>
> The syntax for input interfaces changes ways back in nfdump 1.3 from
> 'input' to 'in if'. This was around May 2005.
> However, the 'as' syntax was stable since it exists.
>
> - Peter
>
> |
> | This change might break modules/scripts that depend on the old filter
> | syntax...
>
>
>
> - --
> _______ SWITCH - The Swiss Education and Research Network ______
> Peter Haag, Security Engineer, Member of SWITCH CERT
> PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.3 (Darwin)
>
> iQCVAwUBSAMFmf5AbZRALNr/AQId1gP9FmfvV6gB2kuyOgCrD7EeBlivkMZNZh7l
> zPLNNeKpWz5jvKavwoq1VYDp+yrjtOJcIpchOORhDOAZaGUZDXPe9GkF+OPCBULR
> 5xUAFufAx7IPhOdVp3jT4GA9WtIn0H6LUu82972UhwxyWpn2e2unbzsFv6s9EHRc
> pqqhzidwbf8=
> =hBUx
> -----END PGP SIGNATURE-----
>
>
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
