Snort mailing list archives
Re: barnyard2 not populating sig_name properly when using EMT rules
From: JJ Cummings <cummingsj () gmail com>
Date: Mon, 9 May 2011 11:46:07 -0500
You can also use a tool like PulledPork to manage your rules, it creates an updated sid-mag.map file for you! Sent from the iRoad On May 9, 2011, at 10:54, Eoin Miller <eoin.miller () trojanedbinaries com> wrote:
On 5/9/2011 3:35 PM, Wm. Josiah Erikson wrote:Hi guys, Has anybody seen anything like this? When I use the default rules, everything populates fine, but when I use the EMT rules, I get things like "Snort Alert [1:2012648:0]" in the sig_name field in the signature table. Looking at the rules definitions, I don't see any obvious reasons why - the signature names are in the same place in the default and EMT rules. Has anybody run across this before? Thanks,You need to update your sid-msg.map file to include the signature names for all the other rules you are loading. This happens when you use something like barnyard or barnyard2 processing unified output. I looks up the name of the signature in the sid-msg.map file to get the human readable names. If it isn't there, then it just uses the sid for the name. cat EMT/sid-msg.map >> /etc/snort/sid-msg.map Then restart barnyard/barnyard2. Look into using something like pulledpork or oinkmaster, it handles and updates your sid-msg.map file for you automatically. -- Eoin ------------------------------------------------------------------------------ WhatsUp Gold - Download Free Network Management Software The most intuitive, comprehensive, and cost-effective network management toolset available today. Delivers lowest initial acquisition cost and overall TCO of any competing solution. http://p.sf.net/sfu/whatsupgold-sd _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------ WhatsUp Gold - Download Free Network Management Software The most intuitive, comprehensive, and cost-effective network management toolset available today. Delivers lowest initial acquisition cost and overall TCO of any competing solution. http://p.sf.net/sfu/whatsupgold-sd _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- barnyard2 not populating sig_name properly when using EMT rules Wm. Josiah Erikson (May 09)
- Re: barnyard2 not populating sig_name properly when using EMT rules Jeff Murphy (May 09)
- Re: barnyard2 not populating sig_name properly when using EMT rules beenph (May 09)
- Re: barnyard2 not populating sig_name properly when using EMT rules Eoin Miller (May 09)
- Re: barnyard2 not populating sig_name properly when using EMT rules JJ Cummings (May 09)
- Re: barnyard2 not populating sig_name properly when using EMT rules Wm. Josiah Erikson (May 09)