Re: Where and when do snort decide which CID to give to a event?

[Paul Schmehl <pauls () utdallas edu>]

Look in the event table.  You have sid, cid, sig and timestamp.  The cid is 
a sequential number that is autoincremented.  IOW, when the next event 
occurs it gets the next available cid.

--On Sunday, April 13, 2003 7:54 PM +0200 jkv <ipwitch () unixcluster dk> 
wrote:

> Hi....
>
> Where and when do snort decide which CID to give to a event?
>
> Ive been looking in the sql tabels snort creates, only place i could find
> anything about cid was in a table created by acid. cid from acid_event.
>
>
> --
> ipwitch
> publickey: http://unixcluster.dk/public.asc
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Etnus, makers of TotalView, The
> debugger  for complex code. Debugging C/C++ programs can leave you
> feeling lost and  disoriented. TotalView can help you find your way.
> Available on major UNIX  and Linux platforms. Try it free. www.etnus.com
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu


-------------------------------------------------------
This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger 
for complex code. Debugging C/C++ programs can leave you feeling lost and 
disoriented. TotalView can help you find your way. Available on major UNIX 
and Linux platforms. Try it free. www.etnus.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users