Re: ACID and sid-msg.map file

[Guillaume Arcas <guillaume.arcas () free fr>]

Bahya NASSR EDDINE a écrit :

> By the way, by which program is the sid-msg.map file
> used?

Programs like Barnyard that do post-processing of trafic dumped by snort.

> I actually download updates for snort rules from
> different URLs, so I have to generate the sid-msg.map
> file using a script... however, I don't know what does
> exactly this file serve to?

It can be used to filter alerts (see thresold.conf file for some
examples). Very usefull to limit or trigger down some verbose
preprocessors and decoders.

Regards,

-- 

Guillaume Arcas
---------------------------------------------------------
"L'amour, comme la foudre et le génie, procède volontiers
par brusques lueurs." (A. Allais)


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users