# problem with using snort rules by bro

**URL:** <https://community.zeek.org/t/problem-with-using-snort-rules-by-bro/1353>\
**Category:** Zeek\
**Created:** [June 26, 2008, 2:39am UTC](https://community.zeek.org/t/problem-with-using-snort-rules-by-bro/1353 "2008-06-26T02:39:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![uday\_chekuri](https://avatars.discourse-cdn.com/v4/letter/u/e480ec/32.png) [@uday\_chekuri](https://community.zeek.org/u/uday_chekuri)\
**Post date:** [June 26, 2008, 2:39am UTC](https://community.zeek.org/t/problem-with-using-snort-rules-by-bro/1353/1 "2008-06-26T02:39:04Z")

</div>

Hi,

I am having a trace file with BID 10108. I am having converted snort rules of version [2.3.2.by](http://2.3.2.by) s2b. My bro version is [1.2.1.](http://1.2.1.) When I run bro on my pcap file it is running with few error compiling patterns. It is not showing me the exact rule related to 10108 BID in alarm and signature file. I think this is due to those error compiling patterns. To solve that I tried the solution in wiki and archive. But no luck. I am sorry for reposting the same issue. I got no reply previously. But please help me with this issue.

Regards,  
Uday.

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [June 26, 2008, 10:58pm UTC](https://community.zeek.org/t/problem-with-using-snort-rules-by-bro/1353/2 "2008-06-26T22:58:40Z")

</div>

Have you tried the most recent Bro version? Do you still see the  
problem with that? If yes, please also try the current trunk  
directly from the Subversion directory. I think this should be  
solved there already.

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/problem-with-using-snort-rules-by-bro/1353/3 "2022-05-06T15:38:35Z")

</div>


