[Snort-users] Fast alert format

François Désarménien francois at ...1754...
Wed Oct 17 01:47:10 EDT 2001


Tue, 16 Oct 2001 14:48:09 -0400
"Ian Melven" <imelven at ...3837...> wrote:

> hullo everyone
> 
> well, i read enough source to assume that the 
> [number:number:number] stuff in my snort fast alerts
> is the 'generator':snort rule id:rule revision
> 
> what are the possible values for the "generator" ?

Look into generator.h

> 
> is the alert format docc'ed anywhere other than
> in the code ? i couldn't really find it in the manual ?

The best up-to-date place to look at is... the sources :-)

F.




More information about the Snort-users mailing list