Understanding IDSkeys - thought I had it but no..........

[Mads Rasmussen <mads () cit com br>]

Hmmm I thought I had it but....

[**] [111:8:1] spp_stream4: STEALTH ACTIVITY (FIN scan) detection [**] 

[**] [111:3:1] spp_stream4: Possible RETRANSMISSION detection [**]  

Then what is the idskey? 

The FAQ doesn't mension this very clearly, what is the procedure exactly? 
first I just had the 111:3:1 key and searched for 111 on the whitehat.com/ids 
site. This gave me info about a trojan but now that a FIN scan gives the same 
number just with different suffix what is the ids key and how do I search for 
it on whitehats?

Regards,

Mads

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users