Snort mailing list archives
Re: Flags rule option
From: Bill McCarty <bmccarty () apu edu>
Date: Thu, 26 Sep 2002 19:34:00 -0700
Hi Marty and all,--On Thursday, September 26, 2002 9:36 PM -0400 Martin Roesch <roesch () sourcefire com> wrote:
What version of Snort are you using? Can you look at the BUGS file and give us a formatted report?
Sure, happy to oblige! The command snort -? reports: -*> Snort! <*- Version 1.8.6 (Build 105) BUGS file information: System Architecture: x86 Operating System and version: Red Hat Linux 7.2 Version of Snort: 1.8.6 What preprocessors you loaded: preprocessor frag2 preprocessor stream4: detect_scans preprocessor http_decode: 80 -unicode -cginull preprocessor rpc_decode: 111 preprocessor telnet_decode preprocessor portscan: XXX.XXX.XXX.XXX/24 5 3 /var/log/snort/portscan preprocessor portscan-ignorehosts: YYY.YYY.YYY.YYY ZZZ.ZZZ.ZZZ.ZZZ What rules (if any) you were using About 448 local rules in addition to a standard rule set. The local rules include: alert tcp any any -> XXX.XXX.XXX.XXX 1024:65535 (flags:S+; flags:A!; msg:"Local suspicious inbound"; ) What output plug-ins you loaded output alert_syslog: LOG_LOCAL1 LOG_INFO output alert_full: /space1/snort/snort-full output alert_fast: /space1/snort/snort-fast output CSV: /space1/snort/snort-csv default What command line switches you were using -D \ -b \ -N \ -c $CDIR \ -i $INTERFACE \ -l $DIRBASE/$WEEK/$DATE \ -L $FILE \ -o \ -u $USER "not ( port XXX and host YYY.YYY.YYY.YYY )" Any Snort error messages: none Cheers, --------------------------------------------------- Bill McCarty ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Flags rule option Bill McCarty (Sep 26)
- Re: Flags rule option Matt Kettler (Sep 26)
- Re: Flags rule option Bill McCarty (Sep 26)
- Re: Flags rule option Martin Roesch (Sep 26)
- Re: Flags rule option Bill McCarty (Sep 26)
- Re: Flags rule option Matt Kettler (Sep 26)