[Snort-users] Flags rule option

Bill McCarty bmccarty at ...5196...
Thu Sep 26 19:35:02 EDT 2002

Hi Marty and all,

--On Thursday, September 26, 2002 9:36 PM -0400 Martin Roesch 
<roesch at ...1935...> wrote:

> What version of Snort are you using?  Can you look at the BUGS file and
> give us a formatted report?

Sure, happy to oblige!

The command snort -? reports:

-*> Snort! <*-
Version 1.8.6 (Build 105)

BUGS file information:

System Architecture: x86

Operating System and version: Red Hat Linux 7.2

Version of Snort: 1.8.6

What preprocessors you loaded:
  preprocessor frag2
  preprocessor stream4: detect_scans
  preprocessor http_decode: 80 -unicode -cginull
  preprocessor rpc_decode: 111
  preprocessor telnet_decode
  preprocessor portscan: XXX.XXX.XXX.XXX/24 5 3 /var/log/snort/portscan
  preprocessor portscan-ignorehosts: YYY.YYY.YYY.YYY ZZZ.ZZZ.ZZZ.ZZZ

What rules (if any) you were using
  About 448 local rules in addition to a standard rule set. The local rules

  alert tcp any any -> XXX.XXX.XXX.XXX 1024:65535 (flags:S+; flags:A!;
  msg:"Local suspicious inbound"; )

What output plug-ins you loaded
  output alert_syslog: LOG_LOCAL1 LOG_INFO
  output alert_full: /space1/snort/snort-full
  output alert_fast: /space1/snort/snort-fast
  output CSV:        /space1/snort/snort-csv default

What command line switches you were using

          -D \
          -b \
          -N \
          -c $CDIR \
          -i $INTERFACE \
          -l $DIRBASE/$WEEK/$DATE \
          -L $FILE \
          -o \
          -u $USER "not ( port XXX and host YYY.YYY.YYY.YYY )"

Any Snort error messages: none


Bill McCarty

More information about the Snort-users mailing list