Re: Another Snort Rules Question

["Scott Elgram" <SElgram () verifpoint com>]

Erik,
    Thankyou for that, I looked into and it may just be what I need,
however......is there a way i can set so it logs like normal, with the
queue, but stops if a particular rule is found true?

-Scott

----- Original Message ----- 
From: "Erik Fichtner" <emf () servervault com>
To: "Scott Elgram" <SElgram () verifpoint com>
Cc: <snort-users () lists sourceforge net>
Sent: Tuesday, September 07, 2004 5:04 PM
Subject: Re: [Snort-users] Another Snort Rules Question


> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Tue, Sep 07, 2004 at 04:38:31PM -0700, Scott Elgram wrote:
> > Hello again,
> >     I have 2 rules....(yes this is pointless and bad practice, I know,
just bare with me here).
> > alert icmp 192.168.0.31 any -> 192.168.0.240 any (msg: "Test ICMP ping
1";)
> > alert icmp 192.168.0.31 any -> 192.168.0.240 any (msg: "Test ICMP ping
2";)
> >     Ok, I am 192.168.31 and I ping 192.168.0.240........In ACID I get 2
alerts.  One for msg: "Test ICMP ping 1" and one for "Test ICMP ping 2".
Now, I could be wrong here but I thought after a packet is shown true to a
rule Snort stops comparing the packet to rules.
> in 2.2.0RC1, they added multiple events in "event_queue". see
doc/README.event_queue.
> You can tune how many alerts will fire on a particular event.  If you're
in an
> environment where you're alerting on more generic misbehavior and have
some
> back-end processor that can handle multiple alerts, it's pretty cool
stuff.
> Otherwise, it can be a little noisier than usual.
>
>
> - -- 
> Erik Fichtner
> Principal Engineer, Information Security, ServerVault Corp.
> 703-652-5900
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.7 (FreeBSD)
>
> iD8DBQFBPkx1Q7EzrewLMS0RAox2AJ9JiMsty53l35OUPukcwLrOXRsbBgCfcsKh
> UJueidsc77etLmireXNEYVA=
> =cpxj
> -----END PGP SIGNATURE-----
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by BEA Weblogic Workshop
> FREE Java Enterprise J2EE developer tools!
> Get your free copy of BEA WebLogic Workshop 8.1 today.
> http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users




-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users