Re: sid-msg.map

[Joel Esler <joel.esler () sourcefire com>]

This identifies the generator of an alert.  This file doesn't change  
very much.  Only when a new preprocessor has been added.

--
Joel Esler
Sent from the road.

On Aug 9, 2007, at 3:17 PM, "snort user" <snort.user () gmail com> wrote:

> Thanks a lot for the reply.
>
> How about the gen-msg.map file ?
> How is that generated?
>
>
> --
>
> On 8/9/07, Nigel Houghton <nigel () sourcefire com> wrote:
> > On  0, snort user <snort.user () gmail com> wrote:
> > > Greetings.
> > >
> > > In the snort rules directory there is a file called sid-msg.map. I
> > > would like to know how this is created?
> > >
> > > Any help is much appreciated.
> >
> > This is an automatically generated file, to create a new one use the
> > create-sidmap.pl from the contrib directory in the oinkmaster  
> > tarball.
> >
> > --
> > Nigel Houghton
> > Office Linebacker
> > SF VRT
> >
> > --- 
> > --- 
> > -------------------------------------------------------------------
> > This SF.net email is sponsored by: Splunk Inc.
> > Still grepping through log files to find problems?  Stop.
> > Now Search log events and configuration files using AJAX and a  
> > browser.
> > Download your FREE copy of Splunk now >>  http://get.splunk.com/
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> --- 
> ----------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a  
> browser.
> Download your FREE copy of Splunk now >>  http://get.splunk.com/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users