[Snort-users] Incorrect SID 108

Todd Wease twease at ...1935...
Tue Oct 31 09:51:36 EST 2006


On Tue, 2006-10-31 at 09:34 +0900, Ian Masters wrote:
> When I click on the 'Snort' link for '(snort_decoder) Unknown Datagram
> decoding problem!' I get information about  BACKDOOR QAZ Worm Client
> Login access. The SID is 108.
> 
> Surely this isn't right.
> 
> Regards
> 
> Ian Masters

What version of Snort are you using and what web interface are you
using?  

Both alerts have the same SID; however, they each have a different
generator id (GID).  It sounds like whatever web interface you are using
is not taking the GID into account when creating the link.

Todd





More information about the Snort-users mailing list