Re: [sentinix-list] Snort work a bit ;-)

On Friday 19 December 2003 10:07, Thierry wrote:
> On 18/12/03   20:39, Michel Blomgren wrote:
> > On Thursday 18 December 2003 20:12, Thierry wrote:
> >
> > Yepp, I thought so...  IE simply doesn't support SnortCenter's
> > javascripts (or one could see it the other way around, I don't care).
> >
> >
> > If you want to see SnortCenter the way the developer intended, use
> > Mozilla or Netscape 6.x+.
>
> I install yesterday night Mozilla win32 on Win 2000, i f=have exactly the
> same results .. Can not push .... Is there any possibilities to do it "by
> hand" to try to see what happen exactly ?? Or should i test it with Nescape
> (not yet installed) ??

heh... weird, although I don't run windows, it works in Mozilla 1.4 and 
Firebird 0.7 under GNU/Linux.  It's also fully working at work, using some 
ver of IE on WinXP.  On a win98 box with IE 6.0x it didn't work.

You can not do it by hand.  The SnortCenter rules are all in a MySQL db, it 
parses it then passes it to the Sensor Agent.

But not to worry, if the javascript isn't working, it's still pushing it, you 
just don't get to see it as fancy as the creator intended, that's all.

>
> > Those "unknown rule" messages can be ignored, you have the sid number
> > there, check the rules listing, search for those sids, you (hopefully)
> > find them in there.
>
> Ok i found them in /usr/local/snort/sensor/rules

See, it's working!  It does push it for you!

However, you don't need to look in any file to see them, use the SnortCenter 
GUI!

	Michel