Snort mailing list archives
Re: Newbie needs help with SID countermeasure
From: Martin Roesch <roesch () sourcefire com>
Date: Mon, 2 Aug 2004 23:17:26 -0400
Hi Kevin,None of those rules is particularly critical, especially if you're running an Apache server. Check the rule documents for those SIDs if you want more info about the particular rules that are firing.
Remember, just because we write a rule doesn't mean you have to run it! -Marty On Jul 30, 2004, at 11:24 PM, Kevin Old wrote:
Hello everyone, I'm still very new to Snort and have got it working with ACID. I'm trying to block offensive activity that is being logged by Snort. I've got a few SID's 1288, 1852, 1013, 1012 that keep showing up in ACID and I'm trying to figure out a way to block them or keep them from showing up in ACID. I've done everything the countermeasures say, but most just say to make sure that packages are up to date. I'm running RH 9.0, with Apache 1.3.31 and the latest mod_frontpage. Any suggestions? -- Kevin Old kevinold () gmail com ------------------------------------------------------- This SF.Net email is sponsored by OSTG. Have you noticed the changes on Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,one more big change to announce. We are now OSTG- Open Source TechnologyGroup. Come see the changes on the new OSTG site. www.ostg.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- Martin Roesch - Founder/CTO, Sourcefire Inc. - (410)290-1616 Sourcefire: Intelligent Security Monitoring roesch () sourcefire com - http://www.sourcefire.com Snort: Open Source Network IDS - http://www.snort.org ------------------------------------------------------- This SF.Net email is sponsored by OSTG. Have you noticed the changes on Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now, one more big change to announce. We are now OSTG- Open Source Technology Group. Come see the changes on the new OSTG site. www.ostg.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Newbie needs help with SID countermeasure Kevin Old (Jul 30)
- Re: Newbie needs help with SID countermeasure Martin Roesch (Aug 02)