Re: Acid 0.9.6b6 Reference Links

[roman () danyliw com]

> > From my rules file "...(msg:"MISC Large ICMP Packet"; dsize: >800;
> reference:arachnids,246;)".
>
> So I should be seeing hyperlinks, right?

Indeed you should see hyperlinks.  Update to ACID v0.9.6b9+

Roman

> ----- Original Message -----
> From: <rdanyliw () voicenet com>
> To: "Brad T." <bthaler () webstream net>
> Cc: <snort-users () lists sourceforge net>
> Sent: Friday, July 20, 2001 10:35 AM
> Subject: Re: [Snort-users] Acid 0.9.6b6 Reference Links
>
>
> > > For example, when snort detects a "Large ICMP Packet", and puts it into
> the
> > > database, Acid shows "MISC Large ICMP Packet" in the "signature" field
> of
> > > its output.  Shouldn't this be a hyperlink to the corresponding entry in
> the
> > > arachnids database?
> >
> > Examine the specific rule "Large ICMP Packet" in the Snort rules
> > file, do you see a corresponding "reference: arachnids, 123"?
> > (the number is unimportant).  I checked the default Snort-1.7
> > rule set and this particular rule did not come with a reference.
> > Hence ACID cannot provide a link for it.
> >
> > If you do have a reference tag though, then this confirms that
> > ACID is broken, which if memory serves, there was a bug in
> > reference support at some point in the past.  I recommend
> > upgrading to a mimimum of b9 to fix this issue.
> >
> > Roman
> >
> > > ----- Original Message -----
> > > From: <roman () danyliw com>
> > > To: "Brad T." <bthaler () webstream net>
> > > Cc: <snort-users () lists sourceforge net>
> > > Sent: Friday, July 20, 2001 10:03 AM
> > > Subject: Re: [Snort-users] Acid 0.9.6b6 Reference Links
> > >
> > >
> > > > > I can't figure out why I'm not able to use the whitehats.com
> reference
> > > > > hyperlinks that acid is supposed to generate.  I'm no PHP programmer
> by
> > > any
> > > > > means, but I can see the code that is supposed to do this in
> > > acid_common.php
> > > > > (lines 379-391 and 414-418).
> > > >
> > > > Do you signatures look like "IDS/100 foo"?
> > > >
> > > > > BTW, I've tried acid-0.9.6b12 and got a bunch of PHP errors, so I
> went
> > > back
> > > > > to b6 for now.
> > > >
> > > > What were these errors?
> > > >
> > > > Roman
> >
> >
> >
> > ---------------------------------------------
> > This message was sent using Voicenet WebMail.
> >       http://www.voicenet.com/webmail/
> >
> >
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > http://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



---------------------------------------------
This message was sent using Voicenet WebMail.
      http://www.voicenet.com/webmail/



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users