Snort mailing list archives
Re: output alert_fast: is not anymore a pipe?
From: "Russ Combs (rucombs)" <rucombs () cisco com>
Date: Fri, 21 Mar 2014 17:46:55 +0000
Are you trying to output alert_fast or unified2? Snort can still do both directly. ________________________________ From: Juan Camilo Valencia [juan.valencia () seguratec com co] Sent: Friday, March 21, 2014 11:52 AM To: snort-users () lists sourceforge net Subject: Re: [Snort-users] output alert_fast: is not anymore a pipe? Hi guys, Any Idea about this, Could Joel give me some guidance to solve this questions about the snort source code. Best Regards On Wed, Mar 19, 2014 at 3:02 PM, Juan Camilo Valencia <juan.valencia () seguratec com co<mailto:juan.valencia () seguratec com co>> wrote: Hi Guys, I'm upgrading snort from 2.9.3 to snort 2.9.6, previously I was using barnyard2 to create the output alert_fast: alert file using unified2 format form snort. Now I upgraded to 2.9.6, I decide to not use barnyard2 for now and only use the feature output alert_fast: directly from snort, and what snort does is create a normal file. What I want to know if this feature changes a long time ago, if is possible ti have that feature back recompiling the code?, or definitely is better to continue using barnyard2 for that purpose?. Thanks for your advance, Best regards, -- JUAN CAMILO VALENCIA VARGAS Ingeniero de Operaciones SeguraTec S.A.S Calle 11 # 43B-50 of 307 Medelllín Colombia “Choose a job you love, and you will never have to work a day in your life” -- JUAN CAMILO VALENCIA VARGAS Ingeniero de Operaciones SeguraTec S.A.S Calle 11 # 43B-50 of 307 Medelllín Colombia “Choose a job you love, and you will never have to work a day in your life”
------------------------------------------------------------------------------ Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. Written by three acclaimed leaders in the field, this first edition is now available. Download your free book today! http://p.sf.net/sfu/13534_NeoTech
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- output alert_fast: is not anymore a pipe? Juan Camilo Valencia (Mar 19)
- Re: output alert_fast: is not anymore a pipe? Juan Camilo Valencia (Mar 21)
- Re: output alert_fast: is not anymore a pipe? Russ Combs (rucombs) (Mar 21)
- Re: output alert_fast: is not anymore a pipe? Juan Camilo Valencia (Mar 21)