[Snort-users] Alert messages and rule identification
cmg at ...671...
Thu May 17 13:46:47 EDT 2001
> The original datagram says it is a DNS query. I get notified via ICMP
> that the destination is unreachable. This looks normal to me. How do I
> find out which rule has triggered this alert. I am not going to remove
> that alert but will modify my DNS resolution.
> Is there a way to make snort dump the rule ID along with the alert dump?
> Any info appreciated.
grep -n 'ICMP Destination Unreachable' *.rules
There is no rule id field in snort rules ( something that would often
come in handy )
Chris Green <cmg at ...671...>
"I'm beginning to think that my router may be confused."
More information about the Snort-users