Re: not write alert file

[Matt Kettler <mkettler () evi-inc com>]

At 03:30 AM 11/14/2003, Hideki Hirata wrote:
> # ping (eth0_address in my server) (enter)
> # ping (same subnet among other host ipaddress ) (enter)
>
> /var/log/snort/alert log not write.!!
> nothing write.

why would pinging your snort box with a normal ping cause an alert?. did 
you add the rules that do this? (by default they are NOT included when 
using the default snort.conf).

pinging on your loopback will likely cause alerts because it's address is 
127.0.0.1, which is pretty unusual..

 pinging a normal machine is pretty normal.. if you logged every such 
incident you'd have a pretty noisy sensor.






-------------------------------------------------------
This SF.Net email sponsored by: ApacheCon 2003,
16-19 November in Las Vegas. Learn firsthand the latest
developments in Apache, PHP, Perl, XML, Java, MySQL,
WebDAV, and more! http://www.apachecon.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users