ACID gives erroneous information

[Erwin Van de Velde <erwin.vandevelde () ua ac be>]

Hi,

I'm using ACID to see the Snort output, but when checking with the raw data, I 
see some mysterious results:
In my event table, I see 80 events (it's just a recently reseted test 
environment :-) ), but acid_alert only contains 38 records!
All other data (number of destination IP's and so on that ACID gives are wrong 
to (logic, as ACID hasn't used all the records it should use...)
What goes wrong? Or is there a way to interpret the events that I'm unaware 
of? (i.e. are not all different records, different alerts?) This still leaves 
me with the question why there are more IP destinations found when I join 
event on iphdr (on sid and cid), as distinct ip addresses clearly belong to 
different event recordings...

Greetings,
Erwin Van de Velde
Student of University of Antwerp
Belgium



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users