Snort mailing list archives
[Fwd: SSH MISMATCH]
From: AllowOverride <allowoverride () gmail com>
Date: Thu, 18 Oct 2012 14:40:54 -0700
forwarding
--- Begin Message --- From: AllowOverride <allowoverride () gmail com>
Date: Wed, 17 Oct 2012 15:10:23 -0700
i am trying to turn off this alert in preproc_rules/preprocessor.rules: #alert ( msg: "SSH_EVENT_PROTOMISMATCH"; sid: 4; gid: 128; rev: 1; metadata: rule-type preproc, service ssh ; classtype:non-standard-protocol;) i commented it out, still it shows up in base. which leads to another logical question: how can one find out where a rule lives in the first place. i figured out from base if i mouse over the snort portion it states: 128-4 which i figured you can grep 128 goto the file, 4 entries down, find it that way. 1. is there another easier way to find them? 2. lastly, how can i turn it off 128-4 for good. thanks ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_sfd2d_oct _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
--- End Message ---
------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_sfd2d_oct
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- [Fwd: SSH MISMATCH] AllowOverride (Oct 22)