Snort mailing list archives
Cerebus Timestamp Problems...
From: "Dusty Hall" <halljer () auburn edu>
Date: Thu, 07 Aug 2003 11:46:19 -0500
Has anyone else experienced problems with Cerebus reporting incorrect dates? I've tried reading unified alerts that use snort with the -U option and alerts without it, but they both report bogus timestamps. Any ideas? Example below: These are alerts detected between 6:00-8:00 CST this morning... --------------- 1 7/13 13:44:23.540000 xx.xx.xx.xx : 0 xx.xx.xx.xx : 0 BAD-TRAFFIC I 1 7/13 13:44:23.580000 xx.xx.xx.xx : 0 xx.xx.xx.xx : 0 BAD-TRAFFIC I 1 7/13 13:44:23.910000 xx.xx.xx.xx : 25 xx.xx.xx.xx : 1264 POLICY SMTP r 1 1/0 00:00:00.000000 0.0.0.0 : 0 0.0.0.0 : 0 SID 1 1 8/13 13:44:24.840000 xx.xx.xx.xx : 41527 xx.xx.xx.xx : 119 WEB-MISC http 1 7/13 13:44:25.260000 xx.xx.xx.xx : 41534 xx.xx.xx.xx : 119 WEB-MISC http 1 7/13 13:44:25.270000 xx.xx.xx.xx : 41534 xx.xx.xx.xx : 119 WEB-ATTACKS i 1 1/0 00:00:00.000000 0.0.0.0 : 0 0.0.0.0 : 0 SID 1 1 8/13 13:44:25.290000 xx.xx.xx.xx : 25 xx.xx.xx.xx : 1265 POLICY SMTP r 1 7/13 13:44:25.370000 xx.xx.xx.xx : 41534 xx.xx.xx.xx : 119 WEB-MISC http 1 7/13 13:44:25.660000 xx.xx.xx.xx1 : 0 xx.xx.xx.xx : 0 BAD-TRAFFIC I 1 7/13 13:44:25.690000 xx.xx.xx.xx : 0 xx.xx.xx.xx : 0 BAD-TRAFFIC I 1 7/13 13:44:25.690000 xx.xx.xx.xx : 0 xx.xx.xx.xx ---------------- -Dusty ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Cerebus Timestamp Problems... Dusty Hall (Aug 07)