[Snort-users] Help with rules

Marcelo Zabani wine14 at ...125...
Mon Jul 21 06:00:12 EDT 2003


Hi guys, sorry if this question is stupid... I'm new to snort...
how can I decode my logs using rules? I ran "snort -i eth1 -l logs -p"
ps: eth1 is internet in my computer, and eth0 is lan
after I did this, I ran nmap -O myip (not localhost), to see what snort 
showed up... but when I enter the logs directory and then my IP, I can't 
find info about TCP/IP fingerprinting, how do I apply snort rules to a log 
file? I guess this is the problem... I'm using Slackware 9, if this can 
help... oh and by the way I can't find my snort installation directory, nor 
the rules archives... I compiled the source, is there any problem?

Thank You
Marcelo Zabani

_________________________________________________________________
MSN Hotmail, o maior webmail do Brasil.  http://www.hotmail.com





More information about the Snort-users mailing list