Snort mailing list archives

Re: Snort-Swatch


From: Edin Dizdarevic <edin.dizdarevic () interActive-Systems de>
Date: Tue, 23 Sep 2003 21:46:09 +0200

Hi,

If you were using logsurfer I could drop you some appropriate
configuration rules. Do you have to use Swatch?

Regards,
Edin

Keaton, Lindamaria wrote:

/usr/bin/local/snort -c /etc/snort/snort.conf
[...]


Is anyone using swatch to email alerts?
If so, can someone tell me how to configure swatch to send entire
content of an alert. Right now I'm getting alerts send but this is all
I'm getting in the body of the email.

TCP TTL:64 TOS:0x0 ID:33690 IpLen:20 DgmLen:1500 DF.
I would like to see source, destination, time, and what the actually
alert is. Anyone have any ideas?



--
Edin Dizdarevic



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: