RE: New rule SID question ...

["Hicks, John" <JHicks () JUSTICE GC CA>]

my bad ... but thanks for the help ;)

John

-----Original Message-----
From: Erek Adams [mailto:erek () theadamsfamily net]
Sent: Friday, July 12, 2002 2:33 PM
To: Hicks, John
Cc: Snort Users (E-mail)
Subject: Re: [Snort-users] New rule SID question ...


On Fri, 12 Jul 2002, Hicks, John wrote:

>       I just got an email anouncing a new M$ Encapsulated SMTP Address
> Vulnerability (attached for reference) and I'm trying to write a new rule
> for this, but have 1 question. What do I assign as a SID??? Do I have to
> look for an unused one from some master list???

http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.3.26

You might also want to send over your rules and info on the vuln to
snort-sigs
since that's where all the signature mongers hide.  :)

Oh, and take one penalty drink.  ;-)

Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Gadgets, caffeine, t-shirts, fun stuff.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users