[Snort-users] Incorrect SID 108
twease at ...1935...
Tue Oct 31 09:51:36 EST 2006
On Tue, 2006-10-31 at 09:34 +0900, Ian Masters wrote:
> When I click on the 'Snort' link for '(snort_decoder) Unknown Datagram
> decoding problem!' I get information about BACKDOOR QAZ Worm Client
> Login access. The SID is 108.
> Surely this isn't right.
> Ian Masters
What version of Snort are you using and what web interface are you
Both alerts have the same SID; however, they each have a different
generator id (GID). It sounds like whatever web interface you are using
is not taking the GID into account when creating the link.
More information about the Snort-users