Snort mailing list archives
Re: Empty alert descriptions
From: SnortFan <SnortFan () yahoo com>
Date: Fri, 10 May 2013 21:07:25 -0400
Hi Elz, We are seeing them in Base and in the database. Today I tried comparing the snort.conf and barnyard.conf files between the working and non-working. I even downloaded the newest snort.conf, gen-msg.map, classification.config and reference.config files. What was done before was copy over a new install of a new snort version with the config files from the previous version. But, that still didn't work. It's like barnyard2 is having problems getting just a few of the descriptions from both the sid-msg.map and gen-msg.map files. It most be something we have configured wrong. I'm tempted to build a new server for Pulledpork and start that over again from scratch and see if the Sid-msg.map file I get is different. Thanks, Ed Sent from a mobile device. On May 10, 2013, at 6:13 PM, beenph <beenph () gmail com> wrote:
On Fri, May 10, 2013 at 12:58 PM, SnortFan <SnortFan () yahoo com> wrote:Hi,Greetings Ed,I recently took over a position over seeing a group of snort sensors and they've been having an issue of empty descriptions on some alerts. This has been going on since before the last admin. Just a few rules seem to generate the empty alerts yet a few of the older sensors don't have this issue. Pulledpork version v0.6.1 is running on a non-sensor and we push the rules and the sid-msg.map files to all sensors from it. It's had snort version 2.9.4.5 GRE (Build 71) installed. We have a script that deploys the new rules and sid-msg.map and then restarts the snort and barnyard2 processes on the sensors. The 4 sensors generating the non-descriptive alerts are running a snort version 2.9.4.5 GRE (Build 71) and barnyard2 version 2.1.11 (Build 318). The 2 sensors not having issues are running a snort version 2.9.2.3 IPv6 GRE (Build 205) and barnyard2 version 2.1.9 (Build 263). On all the sensors the sid-msg.map is the same. The gen-msg.map files do differ but both have entries for the alerts that barnyard2 is picking up with no alerts. Example alerts: Snort Alert [1:16435:0] Snort Alert [119:32:0].Where are you seeing those messages? Which output plugin are you using with barnyard2? Cheers, -elz ------------------------------------------------------------------------------ Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. This 200-page book is written by three acclaimed leaders in the field. The early access version is available now. Download your free book today! http://p.sf.net/sfu/neotech_d2d_may _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. This 200-page book is written by three acclaimed leaders in the field. The early access version is available now. Download your free book today! http://p.sf.net/sfu/neotech_d2d_may _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Empty alert descriptions SnortFan (May 10)
- Re: Empty alert descriptions waldo kitty (May 10)
- Re: Empty alert descriptions beenph (May 10)
- Re: Empty alert descriptions SnortFan (May 10)