Snort mailing list archives
Re: Signature Message, PP, and sid-msg.map
From: JJC <cummingsj () gmail com>
Date: Tue, 4 Dec 2012 09:34:31 -0700
Yeah, I looked at a few of these sids, definitely was an issue with improperly handling certain escaped chars (in the pcre for example).. was fixed and committed a while back. Please let me know if the issue persists. JJC On Sun, Dec 2, 2012 at 9:38 PM, Y M <snort () outlook com> wrote:
Here is a partial list of the sids, I still have to look at the remaining sids and update them. 15167,15168,16282,23493,3691,15147,11257,5693,5760,16313,15306,6467,23098,24229,255,15570,13864,8375,11192,20278,4152,5998,5999,16301,2707,23970,9646,15873,23256,16300, 21849,21845,15415,15420,15184,23492,13364,17579,5710,16482,15362 I will check the SVN, thanks for the info. YM ________________________________ CC: snort-users () lists sourceforge net From: cummingsj () gmail com Subject: Re: [Snort-users] Signature Message, PP, and sid-msg.map Date: Sun, 2 Dec 2012 16:42:45 -0600 To: snort () outlook com It does generate the sid-msg.map file... Can you list the aids that were not included.... There was recently a bug filed and fixed that dealt with certain rules not being included (fixed in SVN) Sent from the iRoad On Dec 2, 2012, at 6:17, Y M <snort () outlook com> wrote: This may have been discussed before but I did not find a definitive answer or an optimal solution. I use PulledPork to generate VRT rules (snort.rules) and the sid-msg.map, etc. The process completes successfully. I run Snort and alerts start showing up, however, I do not get signature messages (sig_name in the DB table) for some rules in there. I only get something like, for examples: "Snort Alert [1:255:19]". This happens to a considerable amount of rules. Since the rules are firing and they exist in the snort.rules file, this means that they have been processed by PulledPork, however, they do not have respective entries in the sid-msg.map file. I updated those manually, both in the database and the sid-msg.map file and now are showing up fine. As snort continues to run, I get new alerts with no signature message and do the updates again and so on. My question(s) is, does PulledPork generate the sid-msg.map file dynamically once it is run? If so, why some rules do not get mapped into the file? I have read in a group discussion (can't remember where!) that this is related to the reorganization of the rules and should go away once everything stabilizes, please correct if I am wrong. This can take an effort to get rules updated to show up properly every time the rules are updated and PulledPork is run. Any help would be appreciated. Thanks in advance. YM ------------------------------------------------------------------------------ Keep yourself connected to Go Parallel: DESIGN Expert tips on starting your parallel project right. http://goparallel.sourceforge.net/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial Remotely access PCs and mobile devices and provide instant support Improve your efficiency, and focus on delivering more value-add services Discover what IT Professionals Know. Rescue delivers http://p.sf.net/sfu/logmein_12329d2d _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Signature Message, PP, and sid-msg.map Y M (Dec 02)
- Re: Signature Message, PP, and sid-msg.map JJ Cummings (Dec 02)
- Re: Signature Message, PP, and sid-msg.map Jeremy Hoel (Dec 02)
- Re: Signature Message, PP, and sid-msg.map Y M (Dec 02)
- Re: Signature Message, PP, and sid-msg.map JJC (Dec 04)
- Re: Signature Message, PP, and sid-msg.map JJ Cummings (Dec 02)