[Snort-users] Smb output
nk99 at ...10637...
Tue Jul 20 23:24:05 EDT 2004
Smb alerting would be soooo sloooow, that snort would start
dropping packets very soon and very fast.
> The changelog says only this:
> "2003-10-20 Chris Green <cmg at ...1935...>
> * configure.in:
> - removed smb alerting since it should be moved to barnyard
> Whether or not it was actually moved to barnyard, I don't know.
> On Tue, 20 Jul 2004 14:48:46 +0200, Maetzky, Steffen (Extern)
> <steffen.maetzky at ...11508...> wrote:
>>I have realized that the smb output plugin isn't available in newer versions
>>The last version with smb support seems to be 2.0.6.
>>Does anyone know why?
>>I know that there was a security-gap because of an external call of a binary
>>executable (smbclient), is that the reason?
>>Is a new plugin available which do that job without risks?
Never put off till tomorrow what you can avoid all together.
More information about the Snort-users