[Snort-sigs] Tagging in snort.

Jim Starke jstarke at ...173...
Thu Nov 1 17:55:04 EST 2001

I'm running snort Version 1.8.2-beta1 (Build 85) logging to mysql under 
Linux 7.0 I am using ACID v0.9.6b17 to view the database.

I have the following rule where I added a tag to log more of the 
session. Snort doesn't give me an error on start up but I'm not seeing 
any other packets being logged to mysql.

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS cmd.exe 
access"; flags: A+; content:"cmd.exe"; tag: session, 60, seconds; 
nocase; classtype:web-application-attack; sid:1002; rev:2;)

Am I placing the tag in the wrong area of the rule? It is logging 
packets but it doesn't appear to be tagging the session that I want to see.

Otherwise snort runs beautifully. [:-)]

Thanks in advance.

Quidquid latine dictum sit, altum viditur.

More information about the Snort-sigs mailing list