[Snort-users] Where and when do snort decide which CID to give to a event?

Paul Schmehl pauls at ...6838...
Sun Apr 13 11:31:02 EDT 2003


Look in the event table.  You have sid, cid, sig and timestamp.  The cid is 
a sequential number that is autoincremented.  IOW, when the next event 
occurs it gets the next available cid.

--On Sunday, April 13, 2003 7:54 PM +0200 jkv <ipwitch at ...8462...> 
wrote:

> Hi....
>
> Where and when do snort decide which CID to give to a event?
>
> Ive been looking in the sql tabels snort creates, only place i could find
> anything about cid was in a table created by acid. cid from acid_event.
>
>
> --
> ipwitch
> publickey: http://unixcluster.dk/public.asc
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Etnus, makers of TotalView, The
> debugger  for complex code. Debugging C/C++ programs can leave you
> feeling lost and  disoriented. TotalView can help you find your way.
> Available on major UNIX  and Linux platforms. Try it free. www.etnus.com
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu




More information about the Snort-users mailing list