[Snort-users] 1.8beta4 and "Classification" garbage

François Désarménien francois at ...1754...
Wed May 2 13:32:05 EDT 2001


Hello, you all.

I'm currently investigating snort, as I have to write a snort agent for an
OpenSource log-consolidation project, and the Classification/Priority
options new to 1.8 were the ones I was waiting/looking for.

So I'm know running 1.8 beta4 from the cvs on Linux and I use the
bunch of snort logs from SN2000 to generate as much alerts I can,
and I noticed some garbage in the Classification field, ie :

...[**] WEB-IIS admin access [**] [Classification: ~P"^R^HÐ2^R^H(~G^R^H] [Priority: 10]...

That is those 12 chars:

0x90 0x22 0x12 0x08 0xD0 0x32 0x12 0x08 0x28 0x87 0x12 0x08

This garbage is consistent: the string is always the same. And the Priority is always set
to 10.

The portscan preprocessor also seems to have trouble with Priority/Classification, as it
sometimes affects (at first sight) random Classification/Priority values to its status reports,
and also generates garbaged Classifications once in a time...

The beta2 suffers the same symptoms...

I've not had time (yet) to investigate further, I hope this helps.

Thanks for snort and for your time,

François




More information about the Snort-users mailing list