[Snort-sigs] Tagging in snort.
jstarke at ...173...
Thu Nov 1 17:55:04 EST 2001
I'm running snort Version 1.8.2-beta1 (Build 85) logging to mysql under
Linux 7.0 I am using ACID v0.9.6b17 to view the database.
I have the following rule where I added a tag to log more of the
session. Snort doesn't give me an error on start up but I'm not seeing
any other packets being logged to mysql.
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS cmd.exe
access"; flags: A+; content:"cmd.exe"; tag: session, 60, seconds;
nocase; classtype:web-application-attack; sid:1002; rev:2;)
Am I placing the tag in the wrong area of the rule? It is logging
packets but it doesn't appear to be tagging the session that I want to see.
Otherwise snort runs beautifully. [:-)]
Thanks in advance.
Quidquid latine dictum sit, altum viditur.
More information about the Snort-sigs