Unified Log Format

["Mario D. Santana" <mds () mariosantana net>]

Hi, all.  I've written a patch to Ethereal to allow it to load unified 
output and display the alert information as a top-level protocol.  This 
lets you do things like search agains snort.sig_generator, etc.

I'm not sure if this email should go to snort-dev, but I thought I'd give 
it a shot here first.  BTW, if anyone wants to try out the patch, let me 
know off-list.

The patch is pretty functional, but I've run into a couple of snags. 
One of these seems to be related to the "fake" packets generated by snort 
to identify port scans.  But sometimes strange things happen, such as 
finding signal IDs of 527 for generator ID 1 -- is this valid?

I've looked through the snort manual, the code, and other likely places. 
Any help or pointers would be appreciated.

TIA,
mds


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users