Home page logo

snort logo Snort mailing list archives

Re: @snort alert
From: waldo kitty <wkitty42 () windstream net>
Date: Thu, 28 Nov 2013 22:11:30 -0500

On 11/28/2013 2:44 AM, anagha b wrote:
I havenot specified any rule just stated snort.

Barnyard giving follwing o/p
I have to specify my rule for detection ? Snort must have signature to detecet
this then why this kind of o/p?

you have a local rule with SID 1000002 but that rule contains no revision 
number... you should add a revision number to all rules you write and make sure 
you increment that revision number any time* you modify the rule...

eg: alert tcp any any -> any any (msg: "TCP packet detected!"; sid: 1; rev: 1;)

* "any time" meaning any time the rule has major changes in the detection 
portion... many systems use a CSV/SVN to keep their rules in for tracking 
changes... the revision number in the rule helps those working with the alerts 
to know exactly which version of the rule they are dealing with...

NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

Rapidly troubleshoot problems before they affect your business. Most IT 
organizations don't have a clear picture of how application performance 
affects their revenue. With AppDynamics, you get 100% visibility into your 
Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

Please visit http://blog.snort.org to stay current on all the latest Snort news!

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]