Question about using tag in snort

[Jim Starke <jstarke () ptd net>]

I'm running snort Version 1.8.2-beta1 (Build 85) logging to mysql under 
Linux 7.0 I am using ACID v0.9.6b17 to view the database.

I have the following rule where I added a tag to log more of the 
session. Snort doesn't give me an error on start up but I'm not seeing 
any other packets being logged to mysql.

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS cmd.exe 
access"; flags: A+; content:"cmd.exe"; tag: session, 60, seconds; 
nocase; classtype:web-application-attack; sid:1002; rev:2;)

Am I placing the tag in the wrong area of the rule?

Otherwise snort runs beautifully. :-)

Thanks in advance.

--
Quidquid latine dictum sit, altum viditur.
http://www.jcsmall.com/homepage



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users