[Snort-users] Smb output

Nerijus Krukauskas nk99 at ...10637...
Tue Jul 20 23:24:05 EDT 2004

   Smb alerting would be soooo sloooow, that snort would start 
dropping packets very soon and very fast.

sekure wrote:
> The changelog says only this:
> "2003-10-20  Chris Green  <cmg at ...1935...>
> 	* configure.in:
> 	  - removed smb alerting since it should be moved to barnyard
> "
> Whether or not it was actually moved to barnyard, I don't know.
> On Tue, 20 Jul 2004 14:48:46 +0200, Maetzky, Steffen (Extern)
> <steffen.maetzky at ...11508...> wrote:
>>I have realized that the smb output plugin isn't available in newer versions
>>of snort.
>>The last version with smb support seems to be 2.0.6.
>>Does anyone know why?
>>I know that there was a security-gap because of an external call of a binary
>>executable (smbclient), is that the reason?
>>Is a new plugin available which do that job without risks?

Never put off till tomorrow what you can avoid all together.

More information about the Snort-users mailing list