Re: Question about rule numbers and Syslog

[Matt Kettler <mkettler () evi-inc com>]

At 01:10 PM 10/25/2004, Truax, Shawn (MBS) wrote:
> When you receive a syslog message from Snort it gives a rule number of 
> #:###:#. For example 1:255:8 is DNS Zone Transfer TCP.  I know that the 
> middle number is the sid for the rule.  My question is what are the other 
> 2 numbers, where do they come from and are they in the acid database anywhere.

The first number is the generator. See the generators file that comes with 
snort for a list.

generator 1 is the rule subsystem. Other generators are the preprocessors 
(ie: spp_portscan, etc)

In the case of the rule subsystem, the other two numbers are the sid and 
revision of the rule. Thus in the above it was sid:255; rev:8 that fired.

In the other generators, the second number designates which particular 
alert the preprocessor is generating. What this number means is specific to 
the given preprocessor.  see gen-msg.map for a list of messages for 
generators other than 1. For generators other than 1 the third is unused 
and always 1. (at least AFAIK).





-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users