Re: ICMP logs

[jan () radio hundert6 de]

> I don't know that this would cause a problem, but my "itype"
> specifications
> look like this ...
>
>   itype: 3;
>
> ... rather than with the quotes and no space.

I tried it without the quotes, without effect. 
 
> Did you comment out the rule that alerts on these packets, or
> alter it so
> that it wouldn't see them?  

That's exactly what I did by now, since I don't see to much use
for it anyway. 
I do also monitor my network devices apart from
using snort, so I guess I'll notice when there's a
network problem aka. port/host/whatever unreachable.


Thanks, anyway. 

Jan
-- 
Radio HUNDERT,6 Medien GmbH Berlin
- EDV -
j.muenther () radio hundert6 de

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users