RE: snort and acid - Traffic Profile by Protocol doesnt update correctly

["Harper, Patrick" <patrick.harper () phns com>]

That is just the traffic that snort saw.  If it matches any rule it gets
put in the alert file and sent to whatever your output option is set
for, in your case the mysql database.  If you ant to make sure your
getting alerts scan it with one of the scanners I have listed at the
bottom of that paper.

 
-----Original Message-----
From: John Oost [mailto:johnoost () hotmail com] 
Sent: Saturday, September 11, 2004 2:31 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] snort and acid - Traffic Profile by Protocol
doesnt update correctly

Hi All,

I just installed snort and acid for the first time and quickly read
through the manuals. I installed snort and Acid on Redhat 9 using
Patrick Harper's installation guide. Everything seems to work fine
except for the "Traffic Profile by Protocol" display of acid. This
display just doesnt seem to update every time. When I run snort -v and
press ctrl-c after a while it tells me that 99% of the traffic was tcp.
The display in Acid displays 79% udp and 3% tcp. Is this display
supposed to show the traffic that snort has "sniffed" or the traffic
that was identified as "bad" ? If it's the first, is this a known error?

Best regards,

_________________________________________________________________
Hotmail en Messenger on the move
http://www.msn.nl/communicatie/smsdiensten/hotmailsmsv2/



-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM. 
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users






Disclaimer:
This electronic message, including any attachments, is confidential and intended solely for use of the intended 
recipient(s). This message may contain information that is privileged or otherwise protected from disclosure by 
applicable law. Any unauthorized disclosure, dissemination, use or reproduction is strictly prohibited. If you have 
received this message in error, please delete it and notify the sender immediately. 





-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users