[Snort-users] Incorrect SID 108

Todd Wease twease at ...1935...
Tue Oct 31 09:51:36 EST 2006

On Tue, 2006-10-31 at 09:34 +0900, Ian Masters wrote:
> When I click on the 'Snort' link for '(snort_decoder) Unknown Datagram
> decoding problem!' I get information about  BACKDOOR QAZ Worm Client
> Login access. The SID is 108.
> Surely this isn't right.
> Regards
> Ian Masters

What version of Snort are you using and what web interface are you

Both alerts have the same SID; however, they each have a different
generator id (GID).  It sounds like whatever web interface you are using
is not taking the GID into account when creating the link.


More information about the Snort-users mailing list