Re: Flags rule option

[Bill McCarty <bmccarty () apu edu>]

Hi Marty and all,

--On Thursday, September 26, 2002 9:36 PM -0400 Martin Roesch 
<roesch () sourcefire com> wrote:

> What version of Snort are you using?  Can you look at the BUGS file and
> give us a formatted report?


Sure, happy to oblige!

The command snort -? reports:

-*> Snort! <*-
Version 1.8.6 (Build 105)



BUGS file information:

System Architecture: x86

Operating System and version: Red Hat Linux 7.2

Version of Snort: 1.8.6

What preprocessors you loaded:
 preprocessor frag2
 preprocessor stream4: detect_scans
 preprocessor http_decode: 80 -unicode -cginull
 preprocessor rpc_decode: 111
 preprocessor telnet_decode
 preprocessor portscan: XXX.XXX.XXX.XXX/24 5 3 /var/log/snort/portscan
 preprocessor portscan-ignorehosts: YYY.YYY.YYY.YYY ZZZ.ZZZ.ZZZ.ZZZ

What rules (if any) you were using
 About 448 local rules in addition to a standard rule set. The local rules
 include:

 alert tcp any any -> XXX.XXX.XXX.XXX 1024:65535 (flags:S+; flags:A!;
 msg:"Local suspicious inbound"; )

What output plug-ins you loaded
 output alert_syslog: LOG_LOCAL1 LOG_INFO
 output alert_full: /space1/snort/snort-full
 output alert_fast: /space1/snort/snort-fast
 output CSV:        /space1/snort/snort-csv default

What command line switches you were using

         -D \
         -b \
         -N \
         -c $CDIR \
         -i $INTERFACE \
         -l $DIRBASE/$WEEK/$DATE \
         -L $FILE \
         -o \
         -u $USER "not ( port XXX and host YYY.YYY.YYY.YYY )"

Any Snort error messages: none

Cheers,

---------------------------------------------------
Bill McCarty


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users