[Snort-users] alert suppression

Jefferson, Shawn Shawn.Jefferson at ...14448...
Wed May 6 17:08:57 EDT 2009

Hi Greg,

Thanks, that explains it!  I'm using BASE, so I'll have to look into how BASE handles tagged packets.


From: Greg Bowser [mailto:topnotcher at ...11827...]
Sent: May 06, 2009 1:49 PM
To: Jefferson, Shawn
Cc: Joel Esler; snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] alert suppression

>Yes I am running some of the emerging-threats rules, and grepping for "tag:" shows quite a few rules that use it.
> Is there no way to determine which rule is generating the "tag: tagged packet" alert? What is it for exactly?
Somtimes, it is nice to see the packets that follow the packet that triggered an alert. (i.e. the response).  The tag keyword accomplishes this.  Any of the rules you found that have the "tag" keyword will tag packets. (exactly which packets and how many is specified in the rule)
If you look at the traffic with the same src/dst ip pair (in either order) before the tagged packets, you should see the rule that started the tagging.
-- Greg

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20090506/5320262d/attachment.html>

More information about the Snort-users mailing list