Re: Alert messages and rule identification

[Chris Green <cmg () uab edu>]

> The original datagram says it is a DNS query. I get notified via ICMP
> that the destination is unreachable. This looks normal to me. How do I
> find out which rule has triggered this alert. I am not going to remove
> that alert but will modify my DNS resolution.
>
> Is there a way to make snort dump the rule ID along with the alert dump?
>
> Any info appreciated.
>
> TIA.

grep -n 'ICMP Destination Unreachable' *.rules

There is no rule id field in snort rules ( something that would often
come in handy )

-- 
Chris Green <cmg () uab edu>
"I'm beginning to think that my router may be confused."

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users