Re: barnyard2 not populating sig_name properly when using EMT rules

[beenph <beenph () gmail com>]

Seem's like you would need to have updated
./barnyard2 -h
<snip>
 -S <file>  Read the sid-msg map from <file>
</snip>

If no signature are found for gid:sid:rev , what you described is what
you will get inserted by default output pluggins.

-elz


On Mon, May 9, 2011 at 11:35 AM, Wm. Josiah Erikson
<wjerikson () hampshire edu> wrote:
> Hi guys,
>     Has anybody seen anything like this? When I use the default rules,
> everything populates fine, but when I use the EMT rules, I get things
> like "Snort Alert [1:2012648:0]" in the sig_name field in the signature
> table. Looking at the rules definitions, I don't see any obvious reasons
> why - the signature names are in the same place in the default and EMT
> rules. Has anybody run across this before?
>     Thanks,
>
> --
> Wm. Josiah Erikson
> Network Engineer
> Hampshire College
> Amherst, MA 01002
> (413) 559-6091
>
>
> ------------------------------------------------------------------------------
> WhatsUp Gold - Download Free Network Management Software
> The most intuitive, comprehensive, and cost-effective network
> management toolset available today.  Delivers lowest initial
> acquisition cost and overall TCO of any competing solution.
> http://p.sf.net/sfu/whatsupgold-sd
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
WhatsUp Gold - Download Free Network Management Software
The most intuitive, comprehensive, and cost-effective network 
management toolset available today.  Delivers lowest initial 
acquisition cost and overall TCO of any competing solution.
http://p.sf.net/sfu/whatsupgold-sd
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users