[Snort-users] ICMP logs

jan at ...206... jan at ...206...
Fri May 25 12:07:02 EDT 2001


> I don't know that this would cause a problem, but my "itype"
> specifications
> look like this ...
> 
>   itype: 3;
> 
> ... rather than with the quotes and no space.

I tried it without the quotes, without effect. 
 
> Did you comment out the rule that alerts on these packets, or
> alter it so
> that it wouldn't see them?  

That's exactly what I did by now, since I don't see to much use
for it anyway. 
I do also monitor my network devices apart from
using snort, so I guess I'll notice when there's a
network problem aka. port/host/whatever unreachable.


Thanks, anyway. 

Jan
-- 
Radio HUNDERT,6 Medien GmbH Berlin
- EDV -
j.muenther at ...206...




More information about the Snort-users mailing list