Snort mailing list archives
Future or presently developed question
From: "Sean Wheeler" <S.Wheeler () netprotect ch>
Date: Mon, 5 Nov 2001 16:07:00 +0100
Hi, With the current webserver attack frenzy we have experienced, I am seeing literally thousands of entries in my logs 99% of which are irrelevant. If I am asking a question which has been asked before please refrain from the fames and rather point me in the direction I am looking for. Is it possible now or in future to analyse response returned by the server, and then have snort decide whether it is worth logging the alert or not ? for example a CodeRed II access to the backdoor dos shell, if the server returns a 404 not found, could snort not report the IDS alert in this case ? I am not asking for a million scenarios, but inparticular a function for just the 404 example, which would reduce the alerts by probably 99 %. If this feature does exist are there any "Heads Up" you have in using this and where would I find documentation specificly on implementing this feature ? I look forward to your constructive responses :) regards Sean _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Future or presently developed question Sean Wheeler (Nov 05)
- Re: Future or presently developed question Chris Green (Nov 05)