Snort mailing list archives
Empty alert descriptions
From: SnortFan <SnortFan () yahoo com>
Date: Fri, 10 May 2013 12:58:03 -0400
Hi, I recently took over a position over seeing a group of snort sensors and they've been having an issue of empty descriptions on some alerts. This has been going on since before the last admin. Just a few rules seem to generate the empty alerts yet a few of the older sensors don't have this issue. Pulledpork version v0.6.1 is running on a non-sensor and we push the rules and the sid-msg.map files to all sensors from it. It's had snort version 2.9.4.5 GRE (Build 71) installed. We have a script that deploys the new rules and sid-msg.map and then restarts the snort and barnyard2 processes on the sensors. The 4 sensors generating the non-descriptive alerts are running a snort version 2.9.4.5 GRE (Build 71) and barnyard2 version 2.1.11 (Build 318). The 2 sensors not having issues are running a snort version 2.9.2.3 IPv6 GRE (Build 205) and barnyard2 version 2.1.9 (Build 263). On all the sensors the sid-msg.map is the same. The gen-msg.map files do differ but both have entries for the alerts that barnyard2 is picking up with no alerts. Example alerts: Snort Alert [1:16435:0] Snort Alert [119:32:0]. Since the sid-msg.map file is the same, I'm thinking that there maybe a miss configuration on the 4 new sensors. How should I go about trouble shooting this? Thanks. Ed ------------------------------------------------------------------------------ Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. This 200-page book is written by three acclaimed leaders in the field. The early access version is available now. Download your free book today! http://p.sf.net/sfu/neotech_d2d_may _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Empty alert descriptions SnortFan (May 10)
- Re: Empty alert descriptions waldo kitty (May 10)
- Re: Empty alert descriptions beenph (May 10)
- Re: Empty alert descriptions SnortFan (May 10)