I'm not familiar with this option, or even where this option would go...
could you give me more info?
thanks!
--
John
On Tue, May 23, 2006 at 12:08:41PM -0400, Eric Lauzon wrote:
Do you use
the option:
output-mode pktkludge
??
Eric Lauzon
[Recherche & D?veloppement]
Above S?curit? / Above Security
T?l : (450) 430-8166
Fax : (450) 430-1858
---------------------------------------
"Premature optimization is the root of all
evil (or at least most of it) in programming."
- Donald Knuth
-----Original Message-----
From: snort-devel-admin@lists.sourceforge.net
[mailto:snort-devel-admin@lists.sourceforge.net] On Behalf Of
John Newman
Sent: 23 mai 2006 12:06
To: snort-users@lists.sourceforge.net;
snort-devel@lists.sourceforge.net
Subject: [Snort-devel] portscan events not showing up in base
Hello,
I'm using snort 2.4.4 but not sfportscan, rather the older
portscan and
portscan2 modules. I've just realized that, although
portscans are being detected just fine, they aren't being
propagated through barnyard into the base database.
e.g.
select * from acid_event where sig_name like '%portscan%' and
timestamp >
'2006-05-01 00:00:00';
returns nothing
If I change the date portion to sometime last month, before I switched
from sfportscan, I get all sorts of results. Does anyone
have any clue
what might be causing this?
thanks,
--
John Newman
Systems Administrator, WebXess Inc.
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web
services, security?
Get stuff done quickly with pre-integrated technology to make
your job easier
Download IBM WebSphere Application Server v.1.0.1 based on
Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&;
dat=121642
_______________________________________________
Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel
AVERTISSEMENT CONCERNANT LA CONFIDENTIALIT?
Le pr?sent message est ? l'usage exclusif du ou des destinataires mentionn?s
ci-dessus. Son contenu est confidentiel et peut ?tre assujetti au secret
professionnel. Si vous avez re?u le pr?sent message par erreur, veuillez nous
en aviser imm?diatement et le d?truire en vous abstenant d'en faire une
copie, d'en divulguer le contenu ou d'y donner suite.
CONFIDENTIALITY NOTICE
This communication is intended for the exclusive use of the addressee
identified above. Its content is confidential and may contain privileged
information. If you have received this communication by error, please notify
the sender and delete the message without copying or disclosing it.
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
_______________________________________________
Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel
--
John Newman
Systems Administrator, WebXess Inc.
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
