[Snort-users] Parsing SID field

Erick Mechler emechler at ...7719...
Tue Jun 3 14:28:07 EDT 2003


:: 	[1:1002:5]
:: 
:: is SID 1002, Revision 5. But what is the 1 telling me? 

Sensor number.

--Erick




More information about the Snort-users mailing list