[Snort-users] Parsing SID field

Brian bmc at ...950...
Tue Jun 3 14:53:03 EDT 2003


On Tue, Jun 03, 2003 at 01:25:49PM -0700, Todd A. Jacobs wrote:
> In an alert file, I can't figure out what the first field of the SID 
> record is telling me. For example:
> 
> 	[1:1002:5]
> 
> is SID 1002, Revision 5. But what is the 1 telling me? 

Generator.  

1 = snort detection engine.

For the full list see:
http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/snort/snort/src/generators.h?rev=1.33

-brian




More information about the Snort-users mailing list