[Snort-users] Question about using tag in snort

Jim Starke jstarke at ...136...
Mon Oct 29 19:41:03 EST 2001

I'm running snort Version 1.8.2-beta1 (Build 85) logging to mysql under 
Linux 7.0 I am using ACID v0.9.6b17 to view the database.

I have the following rule where I added a tag to log more of the 
session. Snort doesn't give me an error on start up but I'm not seeing 
any other packets being logged to mysql.

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS cmd.exe 
access"; flags: A+; content:"cmd.exe"; tag: session, 60, seconds; 
nocase; classtype:web-application-attack; sid:1002; rev:2;)

Am I placing the tag in the wrong area of the rule?

Otherwise snort runs beautifully. :-)

Thanks in advance.

Quidquid latine dictum sit, altum viditur.

More information about the Snort-users mailing list