Snort mailing list archives
Re: Can't suppress Tagged Packet
From: Joel Esler <joel.esler () sourcefire com>
Date: Fri, 26 May 2006 09:40:51 -0400
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Suppose you can copy and paste (take out the IP's) the alert you are getting? Joel Rob Ward wrote:
--On 26 May 2006 13:37 +0200 Dirk Geschke <dirk () geschke-online de> wrote:is it possible that you use the unified output plugin? In this case all rebuild packets from stream4 which raise an alert are stored as the original individual packets. The first is associated with the alert message and all further parts are labeled as "Tagged Packet". So in this case it will not help to suppress it this way. I fear you have to tune your rules to reduce the number of alerts. (Or you can use another output method, AFAIK only the unified output plugin decomposes the rebuild packet with "Tagged Packets".)Hi Dirk, I'm not using the unified output plugin. Regards Rob Ward Network Northwest Support University of Liverpool Computing Services Department ------------------------------------------------------- All the advantages of Linux Managed Hosting--Without the Cost and Risk! Fully trained technicians. The highest number of Red Hat certifications in the hosting industry. Fanatical Support. Click to learn more http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
- -- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFEdwVjKbCSyXHckt4RAnG1AJ0axHHyqOaLhiEFE2AMBMWbB0fvrwCdEY2T AMIu1RVqcMncwQAfCNsiNIQ= =4GM7 -----END PGP SIGNATURE----- ------------------------------------------------------- All the advantages of Linux Managed Hosting--Without the Cost and Risk! Fully trained technicians. The highest number of Red Hat certifications in the hosting industry. Fanatical Support. Click to learn more http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Can't suppress Tagged Packet Rob Ward (May 26)
- Re: Can't suppress Tagged Packet Dirk Geschke (May 26)
- Re: Can't suppress Tagged Packet Rob Ward (May 26)
- Re: Can't suppress Tagged Packet Joel Esler (May 26)
- Re: Can't suppress Tagged Packet Rob Ward (May 26)
- Re: Can't suppress Tagged Packet Joel Esler (May 26)
- Re: Can't suppress Tagged Packet Bamm Visscher (May 26)
- Re: Can't suppress Tagged Packet Rob Ward (May 26)
- Re: Can't suppress Tagged Packet Rob Ward (May 26)
- Re: Can't suppress Tagged Packet Dirk Geschke (May 26)