Attribute Table question

[SnortFan <SnortFan () yahoo com>]

Hi All,
     I've got a question regarding the attribute table feature of snort. 

I work at a company where the group (mine) that is responsible for running the snort sensors is not the group that 
administers the network and servers we monitor. In fact each department has their open IT shop and we are tasked to 
monitor traffic between departments, coming in and going out of the company. We have not been using the attribute table 
feature in snort.  We want to see alerts on all traffic regardless on type and we don't know what IP is hosting what 
service. It looks like using the attributes table would make rules that don't fit it's expected protocol type to be 
ignored. 

One of the departments is now putting in a commercial source fire product and wants our custom rules with metadata: 
service tags to monitor their internal traffic.

1. In our situation where we don't control the ever changing IP space we monitor would using the attributes table 
feature be even possible or helpful?

2. Would adding the "metadata: service " tags to our rules break anything if we don't have any entries in the attribute 
table?

3. Am I totally miss understanding what the attribute table does?

Thanks,
Ed
------------------------------------------------------------------------------
DreamFactory - Open Source REST & JSON Services for HTML5 & Native Apps
OAuth, Users, Roles, SQL, NoSQL, BLOB Storage and External API Access
Free app hosting. Or install the open source package on any LAMP server.
Sign up and see examples for AngularJS, jQuery, Sencha Touch and Native!
http://pubads.g.doubleclick.net/gampad/clk?id=63469471&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!