Re: [Snort-sigs] creating new sigs [newbie]

From: Chris Hare, CISSP, CISA <chare(at)chris-hare.com>
Date: Sat Apr 05 2003 - 12:40:15 EST

Thanks -- unfortunately, the webserver sees them, but snort isn't trigger an alarm. Might be there is something else wrong.

thanks

• Original Message ----- From: "Matt Kettler" <mkettler@evi-inc.com> To: "Chris Hare, CISSP, CISA" <chare@chris-hare.com>; <snort-sigs@lists.sourceforge.net> Sent: Saturday, April 05, 2003 11:07 AM Subject: Re: [Snort-sigs] creating new sigs [newbie]

> for testing use SID's of 1000000 (one million) or higher, which are
what
> >I think is the right signature defined, but I need more information on
the
> >SID. How do I select an SID? is it purely random to test with or what?
> >
> >Thanks
> >
> >Chris
>

---

This SF.net email is sponsored by: ValueWeb: Dedicated Hosting for just $79/mo with 500 GB of bandwidth! No other company gives more support or power for your dedicated server http://click.atdmt.com/AFF/go/sdnxxaff00300020aff/direct/01/

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Sat Apr 5 13:04:38 2003