problem w/sans giac alert files...

jorge perez <[email protected]> Thu, 19 Jun 2003 00:42:36 -0700 (PDT)
Newsgroups gmane.comp.security.ids.snort.snarf
Message-ID <[email protected]>
hello all!!
i'm currently using SnortSnarf-021111.1 w/snort 2.0 on
a red hat 9.0 linux box. snort works fine. snortsnarf
works like a dream with one of my own internal alert
files (thanks guys for an amazing tool!)...
but when i have snortsnarf try to read one of the
alert files (which seem to be in a strange format) for
the sans/giac practical i'm trying to finish up, it
tells me this:

unknown alert format for
line::1822->MY.NET.206.150:137
; skipping

with the first couple of these messages i thought it
was ok, until it started to generate so many more of
these messages that i'm sure it's going to skew the
results i was after. 
i found a couple of people that had a workaround,
which was to change the MY.NET portions of the alert
file with something else like 255.255, which i tried
and it gave me the same error messages.
the sans/giac files aren't in the same kind of log
format that my alert files are in. is there anything
that can be done to the sans/giac log files to make
them work with snortsnarf? any help on what i should
do (if there's anything i CAN do) would let me sleep
at night!
thank you in advance!!

jorge perez


__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com