Snort mailing list archives
Re: alert suppression
From: Greg Bowser <topnotcher () gmail com>
Date: Wed, 6 May 2009 16:48:33 -0400
Yes I am running some of the emerging-threats rules, and grepping for
“tag:” shows quite a few rules that use it.
Is there no way to determine which rule is generating the “tag: tagged
packet” alert? What is it for exactly? Somtimes, it is nice to see the packets that follow the packet that triggered an alert. (i.e. the response). The tag keyword accomplishes this. Any of the rules you found that have the "tag" keyword will tag packets. (exactly which packets and how many is specified in the rule) If you look at the traffic with the same src/dst ip pair (in either order) before the tagged packets, you should see the rule that started the tagging. -- Greg
------------------------------------------------------------------------------ The NEW KODAK i700 Series Scanners deliver under ANY circumstances! Your production scanning environment may not be a perfect world - but thanks to Kodak, there's a perfect scanner to get the job done! With the NEW KODAK i700 Series Scanner you'll get full speed at 300 dpi even with all image processing features enabled. http://p.sf.net/sfu/kodak-com
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- alert suppression Jefferson, Shawn (May 05)
- Re: alert suppression Joel Esler (May 05)
- Re: alert suppression Jefferson, Shawn (May 06)
- Re: alert suppression Joel Esler (May 06)
- Re: alert suppression Jefferson, Shawn (May 06)
- Re: alert suppression Greg Bowser (May 06)
- Re: alert suppression Joel Esler (May 06)
- Re: alert suppression Jefferson, Shawn (May 06)
- Re: alert suppression Jefferson, Shawn (May 06)
- Re: alert suppression CunningPike (May 06)
- Re: alert suppression Jefferson, Shawn (May 06)
- Re: alert suppression Joel Esler (May 05)
- <Possible follow-ups>
- Re: alert suppression Pedro Marinho (May 07)