Snort mailing list archives
Nimda specific logging
From: Subba Rao <subba9 () home com>
Date: Wed, 10 Oct 2001 16:41:50 -0400
Hi, I am trying to log Nimda specific traffic to a file "nimda.log". In snort.conf, I have defined a new ruletype, which is as follows: ruletype nimda { type alert output alert_fast: nimda.log } In my "nimda.rules" file, the rule syntax is as follows: nimda tcp $EXTERNAL_NET 80 -> $HOME_NET any (.......) With this new ruletype, I do not see any nimda specific logging going into the "nimda.log". When I run SnortSnarf on the existing "alert" file, their is mention of the "nimda.rules file" to some alerts. Could someone point out what I am missing for this new ruletype? Thank you in advance. -- Subba Rao subba9 () home com http://members.home.net/subba9/ OpenPGP/GPG public key ID CCB7344E => Time is relative. Here is a new way to look at time. <= http://www.smcinnovations.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Nimda specific logging Subba Rao (Oct 10)
- Re: Nimda specific logging Andrew R. Baker (Oct 10)
- Re: Nimda specific logging Subba Rao (Oct 11)
- Re: Nimda specific logging Andrew R. Baker (Oct 11)
- Re: Nimda specific logging Subba Rao (Oct 11)
- Re: Nimda specific logging Subba Rao (Oct 11)
- Re: Nimda specific logging Subba Rao (Oct 11)
- Re: Nimda specific logging Andrew R. Baker (Oct 10)
- Revisting Nimda specific logging Subba Rao (Oct 11)