[Snort-users] Smb output

Nerijus Krukauskas nk99 at ...10637...
Wed Jul 21 22:48:03 EDT 2004


Frank Knobbe wrote:
> On Wed, 2004-07-21 at 17:13, Michael Sconzo wrote:
>>Ok, if you re-wrote smbclient (or at least the part that does the
>>WinPopUp stuff),
> 
> 
> No, no. I'm saying don't use smbclient at all. Have Snort populate a UDP
> packet and send it out. 

   That could be an option. But...

>>Then that gets into duplicating work etc ... but if you or somebody
>>else does it, I wouldn't complain either, and would probably use it.
> 
> Heh... I don't even have much time at the moment to work on Snortsam. :(
> And since I don't use the SMB alert, there is no incentive for me
> either. Speaking of Snortsam, I'm doing something very similar there.

...no one is interested in rewriting this.

   And one more thing. How many WinPopUp windows you gonna find after 
you've been out for just one hour (e.g. having lunch)? Personally I 
wouldn't want to deal with several hundred open windows at once. :)

-- 
http://nk.tinkle.lt/

The man who sets out to carry a cat by its tail learns something that 
will always be useful and which never will grow dim or doubtful. -- 
Mark Twain.




More information about the Snort-users mailing list