[Snort-users] Alert messages and rule identification

Subba Rao subba9 at ...530...
Thu May 17 14:54:11 EDT 2001


On  0, Chris Green <cmg at ...671...> wrote:
> > 
> > The original datagram says it is a DNS query. I get notified via ICMP
> > that the destination is unreachable. This looks normal to me. How do I
> > find out which rule has triggered this alert. I am not going to remove
> > that alert but will modify my DNS resolution.
> > 
> > Is there a way to make snort dump the rule ID along with the alert dump?
> > 
> > Any info appreciated.
> > 
> > TIA.
> 
> grep -n 'ICMP Destination Unreachable' *.rules
> 
> There is no rule id field in snort rules ( something that would often
> come in handy )
> 

Thank you very for this tip. In my rules list, I do have several 'ICMP
Destination Unreacable' filters. I had to use the icode and itype to pinpoint
the rule.
 
-- 

Subba Rao
subba9 at ...530...
http://members.home.net/subba9/

GPG public key ID 27FC9217




More information about the Snort-users mailing list