I'm having an issue where when I add a custom rule to my WAN interface(SNORT), I can't start the interface, not even the simplest ping rules work now despite having worked just fine all day.
Trouble started after I started doing some test monitoring of some SMB traffic with the following rule:
alert tcp any any -> $HOME_NET[139, 445] (msg:"Home network SMB triggered"; flow:to_server,established; content:"P|00|S|00|E|00|X|00|E|00|S|00|V|00|C"; nocase; reference:url,xinn.org/Snort-psexec.html; reference:url,doc.emergingthreats.net/2010781; classtype:suspicious-filename-detect; sid:2010781; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
Not sure what went wrong, but the rule didn't work, and now my other custom rules don't either(as in they prevent me from starting the interface).
Anyone who knows what has happened?