Re: (no subject)

[Joel Esler <joel.esler () sourcefire com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Santi,

Perhaps I don't understand whats going on.  Your number of alerts
increases when speed increases?

Joel

Santi Benito wrote:
> Hello Joel, I could not respond you before because I have not been at
> home these days.
> My problem was that when my replaying rate from one computer to
> another grows the number of alerts pass from 740 at 20Mb/s to 745 at
> 30Mb/s.
> I am only using p2p.rules and bleeding's p2p rules also .
> I dont understand this issue.
> Another thing is, if it is normal that ethereal catches more p2p
> packets from one pcap file than snort.
> Thanks a lot.
> I think that you have the main configuration of my snort.conf file,no?
> I will be very pleased if you could help me.
>
> Santi
>
> On 5/20/06, Joel Esler <joel.esler () sourcefire com> wrote:
> Maybe I lost the first email, so I can't find the problem, but what is
> the problem you are having?
>
> Joel
>
> Santi Benito wrote:
> > Thanks a lot Martin,but I think that I have the portscan preprocessor
> > disabled from the beginning. I do the probes with this preprocessor
> > configuration in snort.conf:
>
> > preprocessor flow: stats_interval 0 hash 2
> > preprocessor frag2
> > preprocessor stream4: disable_evasion_alerts detect_scans
> > preprocessor stream4_reassemble
> > preprocessor rpc_decode: 111 32771
> > preprocessor bo
> > preprocessor telnet_decode
>
> > I think that for my purpose, see how many alerts of only p2p traffic it
> > detects, I also could disable all the preprocessors, I also saw one
> > time that preprocessor http_inspect generated me a lot of alerts and I
> > disabled it.
> > So if have that configuration, and the problems continues existing,
> > what could be the cause?
> > My professor has told me to use tethereal,and it catches muck more
> > packets than snort, but at 50Mb/s begins dropping packets....so I
> > would like to solve the problem of snort, but I don`t know how.
>
> > Thanks a lot, I expect no to have bored you.
>
> > Santi
>
>
> > -------------------------------------------------------
> > Using Tomcat but need to do more? Need to support web services,
> security?
> > Get stuff done quickly with pre-integrated technology to make your job
> > easier
> > Download IBM WebSphere Application Server v.1.0.1 based on Apache
> Geronimo
> > http://sel.as-us.falkag.net/sel?cmd=k&kid0709&bid&3057&dat1642
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=ort-users
>
> >
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEdINkKbCSyXHckt4RAkVyAKCf02qqMDSwUXf2dXyTUFAFLgRbgQCeI/ay
XH8K58AdcJvzCTAjTmGD92k=
=zIZO
-----END PGP SIGNATURE-----


-------------------------------------------------------
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users