Snort mailing list archives
Re: SSH MISMATCH
From: AllowOverride <allowoverride () gmail com>
Date: Thu, 18 Oct 2012 18:53:35 -0700
Yes I am using pp. That's what is puzzling me. From what the other user said, its built in. i guess i will try to recompile then negate it with snort command. just a few thoughts. thanks n Thu, 2012-10-18 at 20:23 -0400, Michael Steele wrote:
Aren't you using PulledPork? Michael... -----Original Message----- From: AllowOverride [mailto:allowoverride () gmail com] Sent: Wednesday, October 17, 2012 6:10 PM To: snort-users Subject: [Snort-users] SSH MISMATCH i am trying to turn off this alert in preproc_rules/preprocessor.rules: #alert ( msg: "SSH_EVENT_PROTOMISMATCH"; sid: 4; gid: 128; rev: 1; metadata: rule-type preproc, service ssh ; classtype:non-standard-protocol;) i commented it out, still it shows up in base. which leads to another logical question: how can one find out where a rule lives in the first place. i figured out from base if i mouse over the snort portion it states: 128-4 which i figured you can grep 128 goto the file, 4 entries down, find it that way. 1. is there another easier way to find them? 2. lastly, how can i turn it off 128-4 for good. thanks ---------------------------------------------------------------------------- -- Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_sfd2d_oct _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news! ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_sfd2d_oct _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_sfd2d_oct _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- SSH MISMATCH AllowOverride (Oct 18)
- Re: SSH MISMATCH Jefferson, Shawn (Oct 18)
- Re: SSH MISMATCH Michael Steele (Oct 18)
- Re: SSH MISMATCH AllowOverride (Oct 18)
- Re: SSH MISMATCH Joel Esler (Oct 19)
- Re: SSH MISMATCH Castle, Shane (Oct 19)
- Re: SSH MISMATCH Joel Esler (Oct 19)
- Re: SSH MISMATCH AllowOverride (Oct 19)
- Re: SSH MISMATCH waldo kitty (Oct 21)
- Re: SSH MISMATCH AllowOverride (Oct 18)