Snort mailing list archives
Re: (no subject)
From: Joel Esler <joel.esler () sourcefire com>
Date: Wed, 24 May 2006 12:01:40 -0400
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Santi, Perhaps I don't understand whats going on. Your number of alerts increases when speed increases? Joel Santi Benito wrote:
Hello Joel, I could not respond you before because I have not been at home these days. My problem was that when my replaying rate from one computer to another grows the number of alerts pass from 740 at 20Mb/s to 745 at 30Mb/s. I am only using p2p.rules and bleeding's p2p rules also . I dont understand this issue. Another thing is, if it is normal that ethereal catches more p2p packets from one pcap file than snort. Thanks a lot. I think that you have the main configuration of my snort.conf file,no? I will be very pleased if you could help me. Santi On 5/20/06, Joel Esler <joel.esler () sourcefire com> wrote: Maybe I lost the first email, so I can't find the problem, but what is the problem you are having? Joel Santi Benito wrote:Thanks a lot Martin,but I think that I have the portscan preprocessor disabled from the beginning. I do the probes with this preprocessor configuration in snort.conf:preprocessor flow: stats_interval 0 hash 2 preprocessor frag2 preprocessor stream4: disable_evasion_alerts detect_scans preprocessor stream4_reassemble preprocessor rpc_decode: 111 32771 preprocessor bo preprocessor telnet_decodeI think that for my purpose, see how many alerts of only p2p traffic it detects, I also could disable all the preprocessors, I also saw one time that preprocessor http_inspect generated me a lot of alerts and I disabled it. So if have that configuration, and the problems continues existing, what could be the cause? My professor has told me to use tethereal,and it catches muck more packets than snort, but at 50Mb/s begins dropping packets....so I would like to solve the problem of snort, but I don`t know how.Thanks a lot, I expect no to have bored you.Santi------------------------------------------------------- Using Tomcat but need to do more? Need to support web services,security?Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on ApacheGeronimohttp://sel.as-us.falkag.net/sel?cmd=k&kid0709&bid&3057&dat1642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=ort-users
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFEdINkKbCSyXHckt4RAkVyAKCf02qqMDSwUXf2dXyTUFAFLgRbgQCeI/ay XH8K58AdcJvzCTAjTmGD92k= =zIZO -----END PGP SIGNATURE----- ------------------------------------------------------- All the advantages of Linux Managed Hosting--Without the Cost and Risk! Fully trained technicians. The highest number of Red Hat certifications in the hosting industry. Fanatical Support. Click to learn more http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- (no subject) Santi Benito (May 17)
- Re: (no subject) Joel Esler (May 20)
- Message not available
- Re: (no subject) Joel Esler (May 24)
- Message not available
- Re: (no subject) Joel Esler (May 20)