Re: strange rule problem

[Alberto Gonzalez <electron () wwjh net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


> Hi,

Hello,

[...snip...]

> ruletype note
> {
>   type alert
>   output alert_CSV: /somewhere/messages timestamp,msg,src,srcport,dst,dstport,ethsrc,ethdst
> }

try the following....

ruletype note 
{
 
 type alert output
 output_alert_csv: /somewhere/messages timestamp,msg,src,srcport,dst,dstport,ethsrc,ethdst

}

I tried it here with the rules you wrote, they both worked for me. 


[...snip...]

> here are two test rules:
>
> note tcp any any -> any any (msg:"If this does not work what will"; classtype:attempted-recon; sid:1000000; rev:1;)
> note udp 123.123.123.123/32 any -> any 161 (msg:"This should work"; classtype:not-suspicious; sid:1000001; rev:1;)

[...snip...]

>  thanks
> yonah

 Cheers,
 Alberto Gonzalez


- -- 
"Success comes to the person who does today, what you are thinking of doing tomorrow." 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+a2NqORajRLkA7bARAshZAKCQfJzHqUP7IKkz8p8Eq1/PwtvgVwCfboW8
wl9iZbs5Rh5pp4GWBSdkXcY=
=TyHq
-----END PGP SIGNATURE-----



-------------------------------------------------------
This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger 
for complex code. Debugging C/C++ programs can leave you feeling lost and 
disoriented. TotalView can help you find your way. Available on major UNIX 
and Linux platforms. Try it free. www.etnus.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users