Re: gen-msg file

[ll <ibeginhere () gmail com>]

hei ,i tried it, it run the command 
"oinkmaster-2.0/contrib/create-sidmap.pl /etc/snort/rules/ > sid-msg.map
" and I found the new sid-msg.map file ,some sig-msg info defined in my 
rules already in the new file .but even I restart the snort to load the 
config again ,there alarms msg still is number .
what's problem there will be ?

于 2010-7-26 19:07, Joel Esler 写道:
> You need to use the create sig-msg.map script that comes with oinkmaster. 
>
> --
> Sent from my iPad
>
> On Jul 26, 2010, at 2:42 AM, ll <ibeginhere () gmail com> wrote:
>
>   
> > yes, I read that from the user  manual .I wrote a rule like that "gid:200;sid:1000001;rev:1;classtype:web-application-attack;)" 
> > and I modified the gen-msg.map file 
> > # Format: generatorid || alertid || MSG
> > 200 || 1 || test 
> > and the sid-msg.map file
> > 1000001 || browse directory || url,doc.emergingthreats.net/bin/view/Main/TorRules
> > but, the signature indicate in the BASE like that 
> > Snort Alert [200:1000001:0]
> >
> > I want to some message can indicate in the BASE,but not just the number .
> >
> > 于 2010-7-23 19:55, Joel Esler 写道:
> >     
> > > Generatorid is the number of the individual generator (preprocessor, rule), alert id is the number of the individual 
> > > alert, within that generator.
> > >
> > > The MSG describes the first two.
> > >
> > > J
> > >
> > > On Jul 23, 2010, at 6:02 AM, ll wrote:
> > >
> > >   
> > >       
> > > > hi,all
> > > > in the file gen-msg.map
> > > > # Format: generatorid || alertid || MSG
> > > >
> > > > what is that alertid means ? there are not mentioned in the users manual ?
> > > >     
> > > >         
> > >   
> > >       
>
>   
------------------------------------------------------------------------------
The Palm PDK Hot Apps Program offers developers who use the
Plug-In Development Kit to bring their C/C++ apps to Palm for a share 
of $1 Million in cash or HP Products. Visit us here for more details:
http://ad.doubleclick.net/clk;226879339;13503038;l?
http://clk.atdmt.com/CRS/go/247765532/direct/01/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users