At 01:10 PM 10/25/2004, Truax, Shawn (MBS) wrote:
When you receive a syslog message from Snort it gives a rule number of
#:###:#. For example 1:255:8 is DNS Zone Transfer TCP. I know that the
middle number is the sid for the rule. My question is what are the other
2 numbers, where do they come from and are they in the acid database anywhere.
The first number is the generator. See the generators file that comes with
snort for a list.
generator 1 is the rule subsystem. Other generators are the preprocessors
(ie: spp_portscan, etc)
In the case of the rule subsystem, the other two numbers are the sid and
revision of the rule. Thus in the above it was sid:255; rev:8 that fired.
In the other generators, the second number designates which particular
alert the preprocessor is generating. What this number means is specific to
the given preprocessor. see gen-msg.map for a list of messages for
generators other than 1. For generators other than 1 the third is unused
and always 1. (at least AFAIK).
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
