Suggested documentation updates

From ff88597ce0fa5133ee2849ad431da57f59e82708 Mon Sep 17 00:00:00 2001
From: Branden Archer <[email protected]>
Date: Wed, 5 Jul 2017 10:30:27 -0400
Subject: [PATCH 1/8] docs: replace Ethereal with Wireshark

The Ethereal project was renamed Wireshark in 2006:

https://www.wireshark.org/news/20060607.html
---
 doc/snort_manual.tex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/snort_manual.tex b/doc/snort_manual.tex
index bb8e62a..18e1a3f 100644
--- a/doc/snort_manual.tex
+++ b/doc/snort_manual.tex
@@ -247,7 +247,7 @@ something other than the default output format of plain ASCII text.
 
 Once the packets have been logged to the binary file, you can read the packets
 back out of the file with any sniffer that supports the tcpdump binary format
-(such as tcpdump or Ethereal). Snort can also read the packets back by using
+(such as tcpdump or Wireshark). Snort can also read the packets back by using
 the -r switch, which puts it into playback mode. Packets from any tcpdump
 formatted file can be processed through Snort in any of its run modes. For
 example, if you wanted to run a binary log file through Snort in sniffer mode
-- 
2.7.4

From c8054c98bd32b76d4fae5a7cbdec82546453e6e1 Mon Sep 17 00:00:00 2001
From: Branden Archer <[email protected]>
Date: Wed, 5 Jul 2017 12:13:09 -0400
Subject: [PATCH 2/8] docs: use LaTeX table to hold titles for some tables

The tt font was being used for technical terms and command line
examples. Using it also for the table description was confusing.
By putting the table data inside of a LaTeX table the title
will use an expected font and will appear before the table.

Note that using the H layout option for tables requires the
float package.
---
 doc/snort_manual.tex | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/doc/snort_manual.tex b/doc/snort_manual.tex
index 18e1a3f..6fd68b7 100644
--- a/doc/snort_manual.tex
+++ b/doc/snort_manual.tex
@@ -11,6 +11,7 @@
 \usepackage[latin1]{inputenc}
 \usepackage{geometry}
 \usepackage{longtable}
+\usepackage{float}
 \geometry{verbose,letterpaper,tmargin=1in,bmargin=.5in,lmargin=1in,rmargin=1in}
 \usepackage{url}
 %\IfFileExists{url.sty}{\usepackage{url}}
@@ -1388,9 +1389,9 @@ Please note --enable-inline-test cannot be used in conjunction with -Q.
 
 \end{itemize}
 
-\texttt{Behavior of different modes with rule options}
-
-
+\begin{table}[H]
+\centering
+\caption{Behavior of different modes with rule options}
 \begin{tabular}{|l|c|c|p{6cm}|}
 \hline
 Rule Option & Inline Mode & Passive Mode & Inline-Test Mode\\
@@ -1407,11 +1408,12 @@ Rule Option & Inline Mode & Passive Mode & Inline-Test Mode\\
 \texttt{respond} & close session & close session & close session\\
 \hline
 \end{tabular}
+\end{table}
 
 
-\texttt{Behavior of different modes with rules actions}
-
-
+\begin{table}[H]
+\centering
+\caption{Behavior of different modes with rules actions}
 \begin{tabular}{|l|c|c|c|}
 \hline
 Adapter Mode & Snort args & config policy\_mode & Drop Rule Handling\\
@@ -1454,6 +1456,7 @@ Inline & \texttt{ -Q --treat-drop-as-alert} & inline & Alert\\
 Inline & \texttt{ -Q} & inline & Drop\\
 \hline
 \end{tabular}
+\end{table}
 
 \section{Control socket}
 \label{control_socket}
@@ -1509,8 +1512,10 @@ If the same signal is assigned more than once a warning will be logged
 during snort initialization. If a signal handler cannot be installed a warning
 will be logged and that has to be fixed, otherwise the functionality will be lost.
 
-\texttt{Signals used in snort}
 \label{signalactions}
+\begin{table}[H]
+\centering
+\caption{Signals used in snort}
 \begin{tabular}{|l|l|l|}
 \hline
 Signal name & Default value & Action \\
@@ -1535,6 +1540,7 @@ SIGNAL\_SNORT\_READ\_ATTR\_TBL & SIGURG & reload attribute table \\
 SIGNAL\_SNORT\_CHILD\_READY & SIGCHLD & internal use in daemon mode \\
 \hline
 \end{tabular}
+\end{table}
 
 \section{More Information}
 
-- 
2.7.4

From 617d6903ba0aa6b5f4cb20b9340bcf89d69061bb Mon Sep 17 00:00:00 2001
From: Branden Archer <[email protected]>
Date: Wed, 5 Jul 2017 12:16:33 -0400
Subject: [PATCH 3/8] docs: update snort mailing list location

According to the sourceforge page for snort the mailing lists
moved to lists.snort.org.
---
 doc/snort_manual.tex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/snort_manual.tex b/doc/snort_manual.tex
index 6fd68b7..5c4da25 100644
--- a/doc/snort_manual.tex
+++ b/doc/snort_manual.tex
@@ -1562,7 +1562,7 @@ list:
 
 \url{http://marc.theaimsgroup.com/?l=snort-users}
 
-at \[email protected]? provide informative announcements
+at \[email protected]? provide informative announcements
 as well as a venue for community discussion and support. There's a lot to
 Snort, so sit back with a beverage of your choosing and read the documentation
 and mailing list archives.
-- 
2.7.4

From 8d75e219e7f223c34b084d8ec5a77aca797a8331 Mon Sep 17 00:00:00 2001
From: Branden Archer <[email protected]>
Date: Wed, 5 Jul 2017 12:18:42 -0400
Subject: [PATCH 4/8] docs: update location of mailing lists

The previous url no longer works, however information on snort.org
indicates a new url for the mailing lists.
---
 doc/snort_manual.tex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/snort_manual.tex b/doc/snort_manual.tex
index 5c4da25..d8e0570 100644
--- a/doc/snort_manual.tex
+++ b/doc/snort_manual.tex
@@ -1560,7 +1560,7 @@ you may have to type \texttt{snort -\textbackslash{}?} instead of \texttt{snort
 The Snort web page (\url{http://www.snort.org}) and the Snort Users mailing
 list:
 
-\url{http://marc.theaimsgroup.com/?l=snort-users}
+\url{https://www.snort.org/community#mailing_lists}
 
 at \[email protected]? provide informative announcements
 as well as a venue for community discussion and support. There's a lot to
-- 
2.7.4

From 9c5d2268532baa653b3c5766542df2623b621739 Mon Sep 17 00:00:00 2001
From: Branden Archer <[email protected]>
Date: Wed, 5 Jul 2017 13:46:36 -0400
Subject: [PATCH 5/8] docs: place sample snort rule right where it is
 referenced

Before the figure would appear at the end of the page, and it was not
obvious where the figure was. Adding [h] puts the figure in the
exact place in the document it is declared, so it can be seen
right after it is referenced in the text.
---
 doc/snort_manual.tex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/snort_manual.tex b/doc/snort_manual.tex
index d8e0570..6c76ce3 100644
--- a/doc/snort_manual.tex
+++ b/doc/snort_manual.tex
@@ -14157,7 +14157,7 @@ should be taken.
 Figure \ref{Sample Snort Rule} illustrates a sample Snort rule.
 
 \begin{center}
-\begin{figure}
+\begin{figure}[H]
 \begin{verbatim}
     alert tcp any any -> 192.168.1.0/24 111 \
         (content:"|00 01 86 a5|"; msg:"mountd access";)
-- 
2.7.4

From 42f00dddd23638436f404ebcc3dfe46b5be68d45 Mon Sep 17 00:00:00 2001
From: Branden Archer <[email protected]>
Date: Wed, 5 Jul 2017 14:06:27 -0400
Subject: [PATCH 6/8] docs: display port rule example tables where defined

Reading through it was not obvious what text was a figure until
one gets to the bottom of the figure. This lead to some confusion
when reading through and finding these figures appear within a paragraph.

To avoid confusion, show the tables right after they are referenced.
---
 doc/snort_manual.tex | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/snort_manual.tex b/doc/snort_manual.tex
index 6c76ce3..8839012 100644
--- a/doc/snort_manual.tex
+++ b/doc/snort_manual.tex
@@ -14327,7 +14327,7 @@ number of ways to take on different meanings, such as in Figure \ref{port range
 examples}.
 
 \begin{center}
-\begin{figure}
+\begin{figure}[H]
 \begin{verbatim}
     log udp any any -> 192.168.1.0/24 1:1024
 \end{verbatim}
@@ -14357,7 +14357,7 @@ would translate to none, how Zen...). For example, if for some twisted reason
 you wanted to log everything except the X Windows ports, you could do something
 like the rule in Figure \ref{example port negation}.
 
-\begin{figure}
+\begin{figure}[H]
 \begin{verbatim}
     log tcp any any -> 192.168.1.0/24 !6000:6010
 \end{verbatim}
-- 
2.7.4

From e1f491ca73875fc4ec7495ee408c6bf7473b49f2 Mon Sep 17 00:00:00 2001
From: Branden Archer <[email protected]>
Date: Wed, 5 Jul 2017 14:07:10 -0400
Subject: [PATCH 7/8] docs: display snort rule example tables where defined

These rules appear at the top of a page. It is easier to read if the
figures appear right after they are referenced.
---
 doc/snort_manual.tex | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/snort_manual.tex b/doc/snort_manual.tex
index 8839012..479beb3 100644
--- a/doc/snort_manual.tex
+++ b/doc/snort_manual.tex
@@ -14383,7 +14383,7 @@ direction operator did not have proper error checking and many people used an
 invalid token. The reason the $<$- does not exist is so that rules always read
 consistently.
 
-\begin{figure}
+\begin{figure}[H]
 \begin{verbatim}
     log tcp !192.168.1.0/24 any <> 192.168.1.0/24 23
 \end{verbatim}
@@ -14416,7 +14416,7 @@ dynamically enabled when the activate rule id goes off.
 
 Put 'em together and they look like Figure \ref{activate/dynamic rule example}.
 
-\begin{figure}
+\begin{figure}[H]
 \begin{verbatim}
     activate tcp !$HOME_NET any -> $HOME_NET 143 (flags:PA; \
         content:"|E8C0FFFFFF|/bin"; activates:1;  \
-- 
2.7.4

From 38e70e578d52bad36a086d1e20a2dce7d59b3bb5 Mon Sep 17 00:00:00 2001
From: Branden Archer <[email protected]>
Date: Wed, 5 Jul 2017 14:13:31 -0400
Subject: [PATCH 8/8] docs: update mailing list location for snort-devel

---
 doc/snort_manual.tex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/snort_manual.tex b/doc/snort_manual.tex
index 479beb3..e7d0876 100644
--- a/doc/snort_manual.tex
+++ b/doc/snort_manual.tex
@@ -20123,7 +20123,7 @@ this stuff for their own IDS purposes). Bug fixes are what goes into
 \section{Submitting Patches}
 
 Patches to Snort should be sent to the
-\[email protected]!
+\[email protected]!
 mailing list.  Patches should done with the command
 \verb!diff -nu snort-orig snort-new!.
 
-- 
2.7.4