Re: 1.8beta4 and "Classification" garbage

[Martin Roesch <roesch () sourcefire com>]

Could you try version 1.8-beta4 (Build 18) please and let us know how it
goes?

     -Marty


"François Désarménien" wrote:
> Hello, you all.
>
> I'm currently investigating snort, as I have to write a snort agent for an
> OpenSource log-consolidation project, and the Classification/Priority
> options new to 1.8 were the ones I was waiting/looking for.
>
> So I'm know running 1.8 beta4 from the cvs on Linux and I use the
> bunch of snort logs from SN2000 to generate as much alerts I can,
> and I noticed some garbage in the Classification field, ie :
>
> ...[**] WEB-IIS admin access [**] [Classification: ~P"^R^HÐ2^R^H(~G^R^H] [Priority: 10]...
>
> That is those 12 chars:
>
> 0x90 0x22 0x12 0x08 0xD0 0x32 0x12 0x08 0x28 0x87 0x12 0x08
>
> This garbage is consistent: the string is always the same. And the Priority is always set
> to 10.
>
> The portscan preprocessor also seems to have trouble with Priority/Classification, 

as it
> sometimes affects (at first sight) random Classification/Priority values to its status reports,
> and also generates garbaged Classifications once in a time...
>
> The beta2 suffers the same symptoms...
>
> I've not had time (yet) to investigate further, I hope this helps.
>
> Thanks for snort and for your time,
>
> François
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

--
Martin Roesch
roesch () sourcefire com
http://www.sourcefire.com - http://www.snort.org

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users