[Snort-devel] POP UP Alerts on the Desktop ......
atul_iet at ...398...
Tue Nov 12 21:30:03 EST 2002
This is in response to your following mail.
I am also facing a problem which is related to your problem.
I want that the snort will send POP Up messages to any machine and it is displayed in the monitor.
I am using SnortCenter for configuring it. In the create outplugin, there is a option that can create ALERT SMB (Send WinPopup alert messages to the NETBIOS named machines). When I click on the select, then there is this message:
Alert_smb: Send WinPopup alert messages to the NETBIOS named machines Workstation filename [input]
When I click on the update and then make it active, it becomes active and when i restarts the snort after pushing it, then it also restart with the new settings, but it doesn't give any POP-UP messages.
Can you give me the solution.
Thanks in advance.
Ragards and have a nice day,
I hope this is no drinking question ;-)
I was not able to get smbalerts and the resp: rst_all to work, although I
think I have
configured snort correctly:
./configure --with-mysql --enable-smbalerts --enable-flexresp; make
and I think I can remember seeing the appropriate DENABLE variables floating
over the screen during compile time.
Maybe I have misunderstood something?
alert_smb: <alert workstation filename>
output alert_smb: workstation.list
I have added to my snort.conf:
output alert_smb: /root/snort/smbhosts
Where smbhosts contains only one Netbiosname of the machine that should be
I have also tried to give the IP address instead.
My smb client on SuSE 7.3 works - I have checked this, too.
Snort does not complain about this, but it does not say anything like:
"configured to use smbalerts"
I also thought, maybe I have to add the line:
to the config file or to use this syntax to specify the hosts within the
None of these variants worked.
Now to the flexresp problem:
I have no IP Address assigned to the sniffing interface. Maybe that is a
reason for snort
not being able to reset the connections. I cannot see any RST packets in
My original idea was that libnet should be able to spoof IP Addresse
regardless if the interface has an IP address assigned or not, but maybe I am wrong
I actually can see snort writing something like "libnet critical" to the
Thanks for your help.
Do you Yahoo!?
U2 on LAUNCH - Exclusive medley & videos from Greatest Hits CD
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-devel