Re: Alert messages and rule identification

[Subba Rao <subba9 () home com>]

On  0, Chris Green <cmg () uab edu> wrote:
> > The original datagram says it is a DNS query. I get notified via ICMP
> > that the destination is unreachable. This looks normal to me. How do I
> > find out which rule has triggered this alert. I am not going to remove
> > that alert but will modify my DNS resolution.
> >
> > Is there a way to make snort dump the rule ID along with the alert dump?
> >
> > Any info appreciated.
> >
> > TIA.
>
> grep -n 'ICMP Destination Unreachable' *.rules
>
> There is no rule id field in snort rules ( something that would often
> come in handy )

Thank you very for this tip. In my rules list, I do have several 'ICMP
Destination Unreacable' filters. I had to use the icode and itype to pinpoint
the rule.
 
-- 

Subba Rao
subba9 () home com
http://members.home.net/subba9/

GPG public key ID 27FC9217

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users