problem w/sans giac alert files...
jorge perez <[email protected]> Thu, 19 Jun 2003 00:42:36 -0700 (PDT)
| Newsgroups | gmane.comp.security.ids.snort.snarf |
|---|---|
| Message-ID | <[email protected]> |
hello all!! i'm currently using SnortSnarf-021111.1 w/snort 2.0 on a red hat 9.0 linux box. snort works fine. snortsnarf works like a dream with one of my own internal alert files (thanks guys for an amazing tool!)... but when i have snortsnarf try to read one of the alert files (which seem to be in a strange format) for the sans/giac practical i'm trying to finish up, it tells me this: unknown alert format for line::1822->MY.NET.206.150:137 ; skipping with the first couple of these messages i thought it was ok, until it started to generate so many more of these messages that i'm sure it's going to skew the results i was after. i found a couple of people that had a workaround, which was to change the MY.NET portions of the alert file with something else like 255.255, which i tried and it gave me the same error messages. the sans/giac files aren't in the same kind of log format that my alert files are in. is there anything that can be done to the sans/giac log files to make them work with snortsnarf? any help on what i should do (if there's anything i CAN do) would let me sleep at night! thank you in advance!! jorge perez __________________________________ Do you Yahoo!? SBC Yahoo! DSL - Now only $29.95 per month! http://sbc.yahoo.com