Re: problem w/sans giac alert files...

There is corruption in the alert files.  Remove any such lines and also 
change MY.NET to a numerical prefix.

Jason Falciola
Information Security Analyst
IBM Managed Security Services
[email protected]





jorge perez <[email protected]>
Sent by: [email protected]
06/19/2003 03:42 AM

 
        To:     [email protected]
        cc: 
        Subject:        [Snortsnarf] problem w/sans giac alert files...



hello all!!
i'm currently using SnortSnarf-021111.1 w/snort 2.0 on
a red hat 9.0 linux box. snort works fine. snortsnarf
works like a dream with one of my own internal alert
files (thanks guys for an amazing tool!)...
but when i have snortsnarf try to read one of the
alert files (which seem to be in a strange format) for
the sans/giac practical i'm trying to finish up, it
tells me this:

unknown alert format for
line::1822->MY.NET.206.150:137
; skipping

with the first couple of these messages i thought it
was ok, until it started to generate so many more of
these messages that i'm sure it's going to skew the
results i was after. 
i found a couple of people that had a workaround,
which was to change the MY.NET portions of the alert
file with something else like 255.255, which i tried
and it gave me the same error messages.
the sans/giac files aren't in the same kind of log
format that my alert files are in. is there anything
that can be done to the sans/giac log files to make
them work with snortsnarf? any help on what i should
do (if there's anything i CAN do) would let me sleep
at night!
thank you in advance!!

jorge perez


__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com
_______________________________________________
SnortSnarf-users mailing list
[email protected]
http://www.silicondefense.com/mailman/listinfo/snortsnarf-users