I constantly get these alerts from the citrix server:
ID < Signature > < Timestamp > < Source Address
< Dest. Address > < Layer 4 Proto >
#600-(2-7409) [snort] spp_portscan
from 10.1.10.6: 1 connections across 1 hosts: TCP(1),
UDP(0) 2005-11-15 09:49:12 10.1.10.6
unknown IP
#601-(2-7410) [snort] spp_portscan
from 10.1.10.6: 1 connections across 1 hosts: TCP(1),
UDP(0) 2005-11-15 09:49:19 10.1.10.6
unknown IP
#602-(2-7411) [snort] spp_portscan
from 10.1.10.6: 1 connections across 1 hosts: TCP(1),
UDP(0) 2005-11-15 09:49:59 10.1.10.6
unknown IP
*********
I use these
suppress gen_id 100, sig_id 1
suppress gen_id 100, sig_id 2
suppress gen_id 100, sig_id 3
but it does not work.
Any idea?
Thanks,
John
--- Jeruvy <jeruvy@shaw.ca> wrote:
Sorry about that, I routinely delete emails from
@yahoo.com due to spam.
What is the alert SID? Do you use oinkmaster?
J.
j e r u v y a t s h a w d o t c a
-----Original Message-----
From: John Friedman [mailto:jfriedmanx@yahoo.com]
Sent: Tuesday, November 15, 2005 8:45 AM
To: snort
Subject: RE: [Snort-users] No clue?
Hi all,
Since I did not get any reply on this, is there
any way to
suppress or pass this alert?
Thanks,
John
John Friedman <jfriedmanx@yahoo.com> wrote:
Thanks for your pointing out. Here is the info
again:
ID <
__________________________________
Yahoo! FareChase: Search multiple travel sites in one click.
http://farechase.yahoo.com
-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc. Get Certified Today
Register for a JBoss Training Course. Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
