RE: Alert but NOT log?

["Sheahan, Paul (PCLN-NW)" <Paul.Sheahan () priceline com>]

Interesting.....I tried this feature out, but it doesn't appear to work.

I added this to snort.conf:

ruletype info
{  
 type alert
 output alert_fast: alert
 output log_null
}

Then created a rule like this:

info tcp $EXTERNAL_NET any -> any 80 (msg:"HTTrack crawler detected";
content: "HTTrack"; nocase;)

The alert worked, but it was also logged.

I'm using Version 1.8.4 (Build 99) on RHLinux7.0

Anyone else get this feature to work?


Thanks!

Paul Sheahan
Manager of Information Security
Priceline.com
paul.sheahan () priceline com



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users