[Snort-users] 2 bugs in ACID v0.9.6b17

roman at ...438... roman at ...438...
Fri Nov 2 07:35:06 EST 2001


Hard-coding URLs into ACID was never a good idea.  ACID used to hardcode
links to a ports database, traceroute front-end, and whois server.
In 0.9.6b16 and 0.9.6b17, various configuration variables were introduced
so that the user could configure and maintain the links to external sites.

 o $external_whois_link
 o $external_dns_link
 o $external_all_link
 o $external_port_link

A configurable method to set the URL for the external references allows
users to chose their preferred lookup site, as well as allows for much easier
updating should a URL change.

Erik: If you have a version of ACID which still used
"snort.org/Database/portsearch.asp?number=" for port lookups, it is older
than 0.9.6b16.  You may want to consider upgrading.

Brian: Thanks for confirming the new Snort ports database URL.  It is
indeed the one that was already configured in the sample configuration
file.  Incidentally, I had not noticed that I could also search by name.
This is quite useful.  I searched "ssh" and got back the obvious 22/tcp
and 22/udp, but also 510/tcp (t0rnkit-sshd), etc.

cheers,
Roman

On Fri, 2 Nov 2001, 'Brian ' wrote:

> According to Erik Melander:
> > The link I follow from ACID to snort.org does not
> > work(http://www.snort.org/Database/portsearch.asp?number=)
> > I get the error these are not the pages you are looking for.
> > If it is the case that snort.org is more recent, then I guess
> > ACID should not point to portsdb.org anymore :)
>
> Thats cause that is from the old site.
>
> http://www.snort.org/ports.html?port=PORTNUMBER
>
> You can use names or numbers.
>
> -brian
>


---------------------------------------------
This message was sent using Voicenet WebMail.
      http://www.voicenet.com/webmail/






More information about the Snort-users mailing list