Snort mailing list archives
Re: Alerts problem
From: Martin Roesch <roesch () sourcefire com>
Date: Thu, 11 May 2006 12:13:24 -0400
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1Are portscan alerts being set off? Can you get a count of the alerts by GID:SID?
-Marty On May 11, 2006, at 12:08 PM, Santi Benito wrote:
Hi again snorters, I have a huge problem that I don't understand. How is possible that replaying the same file at 20 Mb/s the number of alerts is 12332 and replaying the file at 50Mb/s the alerts are 12675.At 100 Mb/s the rules reach 12805 and this number maintains like that until the 350 Mb/s. I am using only the p2p.rules rules and I have added the p2p_bleeding.rules but I am using only the rules for eDonkey,cancelling the rest. Could anyone respond me to this X-file situation? thanks -------------------------------------------------------Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimohttp://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
- -- Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616 Sourcefire - Security for the Real World - http://www.sourcefire.com Snort: Open Source Network IDS - http://www.snort.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (Darwin) iD8DBQFEY2Klqj0FAQQ3KOARAuIRAJ9k9IaA964foZKNTA9gYYpBbiM6AgCdF+dI WXGqDHHtpiZv5UVFVmYLw9s= =zSFO -----END PGP SIGNATURE----- ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Alerts problem Santi Benito (May 11)
- Re: Alerts problem Martin Roesch (May 11)