Snort mailing list archives
Use of Host Attribute table, Frag3, and Stream 5 question
From: "Andy Berryman" <aberryman () Cymtec com>
Date: Thu, 29 Apr 2010 12:24:46 -0500
If I'm using a host attribute table that I generated with nmap and Hogger, but my snort.conf only has these two lines: preprocessor frag3_global: max_frags 65536 preprocessor frag3_engine: policy first detect_anomalies timeout 180 What will it do when it gets to a host in the attribute table that is a linux machine or a Cisco IOS? Will the attribute file basically only be good for the OS's that are the "first" category? Meaning that I'm really only using the attribute table to look at the hosts that are running Windows, MacOS, or HP-UX? I know I can specify more "policies" in the snort.conf but, I have to bind IP's to that policy. Which can be time consuming when machines are constantly being added and removed. Thanks, Andy Berryman ############################################################################### This message from Cymtec Systems, Inc. contains confidential information and is solely for the use of the recipient(s) named above. If you are not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this message in error and that any review, disclosure, copying, distribution or use of the contents of this message is strictly prohibited. If you have received this message in error, please destroy it immediately and notify Cymtec Systems, Inc. by telephone at +1.314.993.8700 or by return e-mail. ###############################################################################
------------------------------------------------------------------------------
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Use of Host Attribute table, Frag3, and Stream 5 question Andy Berryman (Apr 29)
- Re: Use of Host Attribute table, Frag3, and Stream 5 question Crook, Parker (Apr 29)
- Re: Use of Host Attribute table, Frag3, and Stream 5 question Andy Berryman (Apr 29)
- Re: Use of Host Attribute table, Frag3, and Stream 5 question Crook, Parker (Apr 29)
- Re: Use of Host Attribute table, Frag3, and Stream 5 question Andy Berryman (Apr 29)
- Re: Use of Host Attribute table, Frag3, and Stream 5 question Crook, Parker (Apr 29)