Re: Hard choice: Preprocessor or Tagging

[Chris Green <cmg () sourcefire com>]

[ please obey Reply-to: ]


Michael Boman <michael.boman () securecirt com> writes:

> > Which preprocessor?  The only ones that only call alerts are things
> > like portscans to my knowledge.

We could log the packet as well, it doesn't make a lot of sense out of
context but it is doable.

> Yupp. Portscan is the one.. Don't run SPADE and don't see so much stream4 
> activity anyway so I wouldn't know.
>
> Is there any way to get tagged packets to have a signature name like 'tagged 
> packet' or something?

I don't know about the database output plugin.   They are meant to be
logged based off the event id that triggered them.  

> PS:
>  I've hacked the sourcecode of spo_database.c so it ignores the BFP part. It's 
> an easy hack but if anyone wants a diff file please let me know.
> DS

Make it a option in the output line and I'll include it.
-- 
Chris Green <cmg () sourcefire com>
This is my signature. There are many like it but this one is mine.


-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users