Re: how enable icmp snort-2.9.6.1

[hernani <coelho.hernani () sapo pt>]

Em 17-06-2014 18:17, waldo kitty escreveu:
> On 6/17/2014 9:03 AM, hernani wrote:
> [...]
> > *so snort detect icmp but not put in BASE*
> >
> > can someone help me??
> please, have you read and followed up on the other list replies to your queries?
> have you created the necessary stream5_icmp section?
hello,

yes i create stream5_icmp

were is the snort.conf

preprocessor stream5_global: track_tcp yes, \
    track_udp yes, \
    track_icmp yes, \
    max_tcp 262144, \
    max_udp 131072, \
    max_active_responses 2, \
    min_response_seconds 5
preprocessor stream5_icmp:

but no udp and icmp alerts are show in BASE.

thanks

hernani

------------------------------------------------------------------------------
HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
Find What Matters Most in Your Big Data with HPCC Systems
Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
Leverages Graph Analysis for Fast Processing & Easy Data Exploration
http://p.sf.net/sfu/hpccsystems
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!