[Snort-users] Smb output

Nerijus Krukauskas nk99 at ...10637...
Tue Jul 20 23:24:05 EDT 2004


   Smb alerting would be soooo sloooow, that snort would start 
dropping packets very soon and very fast.

sekure wrote:
> The changelog says only this:
> 
> "2003-10-20  Chris Green  <cmg at ...1935...>
> 	* configure.in:
> 	  - removed smb alerting since it should be moved to barnyard
> "
> 
> Whether or not it was actually moved to barnyard, I don't know.
> 
> 
> On Tue, 20 Jul 2004 14:48:46 +0200, Maetzky, Steffen (Extern)
> <steffen.maetzky at ...11508...> wrote:
> 
>>Hi,
>>
>>I have realized that the smb output plugin isn't available in newer versions
>>of snort.
>>The last version with smb support seems to be 2.0.6.
>>
>>Does anyone know why?
>>I know that there was a security-gap because of an external call of a binary
>>executable (smbclient), is that the reason?
>>Is a new plugin available which do that job without risks?
>>
>>Greetings,
>>
>>Steffen
-- 
http://nk.tinkle.lt/

Never put off till tomorrow what you can avoid all together.




More information about the Snort-users mailing list