Snort mailing list archives

Open appid problème


From: Kondi AGBA GNANDI via Snort-users <snort-users () lists snort org>
Date: Thu, 31 May 2018 17:06:47 +0000

Hi all sorry for my Bad english i'm french.
I install snort 2.9.11.1 and add openappid
But my problem is when i want be alert on Facebook openning .i configure
the local.rules file with Facebook rule
Alert tcp any  any -> any any (msg:"connectif toi Facebook";appid: Facebook
;sid:10000002;rdv:002;)
when i go with cmd (wget www.facebook.com) all IS good i detect Facebook
trafic,but when i use firefox i dont detect anything
I Also get when using snort console commande the error
Could not read appName.line snort différés Appkey vmware-remote-auth ->
vmware-remote-auth
AppInfo :appid 4109 IS unknown (i have about ten Line with different id)
Thanks alot
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Current thread: