Re: [Snort-users] strange rule problem

From: Alberto Gonzalez <electron(at)wwjh.net>
Date: Sun Mar 09 2003 - 10:53:10 EST

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Hi,

Hello,

[...snip...]

>
> ruletype note

try the following....

ruletype note
{  

 type alert output
 output_alert_csv: /somewhere/messages timestamp,msg,src,srcport,dst,dstport,ethsrc,ethdst

}

I tried it here with the rules you wrote, they both worked for me.

[...snip...]

>
> here are two test rules:

[...snip...]

> thanks
> yonah
>
>

 Cheers,
 Alberto Gonzalez

• -- "Success comes to the person who does today, what you are thinking of doing tomorrow."

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+a2NqORajRLkA7bARAshZAKCQfJzHqUP7IKkz8p8Eq1/PwtvgVwCfboW8 wl9iZbs5Rh5pp4GWBSdkXcY=
=TyHq
-----END PGP SIGNATURE-----

---

This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger for complex code. Debugging C/C++ programs can leave you feeling lost and disoriented. TotalView can help you find your way. Available on major UNIX and Linux platforms. Try it free. www.etnus.com

---

Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users Received on Sun Mar 9 11:25:21 2003