[Snort-users] BASE SID Lookup

Briggs, Bruce Bruce.Briggs at ...13183...
Wed Apr 6 09:58:32 EDT 2005


Yes, annoying isn't it.
 
Enter 119:4 to get the correct display.
http://www.snort.org/pub-bin/sigs.cgi?sid=119%3A4
 
You can find  http_inspect: BARE BYTE UNICODE ENCODING   in
Snort\rules\gen-msg.map
That tells you that the snort general alert and tag is 119 & 4 
 
Then you can read a description in 119-4.txt in    Snort\doc\signatures
or   enter  SID 119:4 on the Snort site.
 
Bruce

  _____  

From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Dominic
Sent: Wednesday, April 06, 2005 10:44 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] BASE SID Lookup



HI,

 

I have recently started using BASE1.1 for snort. I am having a problem
looking up the signature database from the snort webpage - I get "Sorry,
no such sid-gen" for a lot of the events logged (eg: BARE BYTE UNICODE
ENCODING which is SID=4) when I reference the snort site.

 

Thanks

Dominic.

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050406/709c3acb/attachment.html>


More information about the Snort-users mailing list