[Snort-users] snort classification Question

Joel Esler jesler at ...1935...
Tue Aug 21 21:47:03 EDT 2012


I'm not going to do that. You need to read the manual for how the rules work and then you need to read the references found in the rules themselves. We're not going to explain 22,000+ rules. :)

Thanks, but you need to read some documentation. 

--
Joel Esler
Sent from my iPad 

On Aug 21, 2012, at 9:01 PM, mohamad hosein jafari <smhjafari68 at ...11827...> wrote:

> Yes . But  
> I want reference for my need. Because I think that is too much .
> Thanks
> 
> On Aug 22, 2012 2:54 AM, "Joel Esler" <jesler at ...1935...> wrote:
> So, to be clear, you want me to explain all the rules to you?
> 
> 
> On Aug 21, 2012, at 3:16 PM, mohamad hosein jafari <smhjafari68 at ...14459.....> wrote:
> 
>> 
>> You'd have to look in the rules themselves for what rules use this classification.  For instance, non-standard-protocol, actually only has one rule that uses it.
>>  
>> The classifications are assigned by the VRT member who writes the rule, and then when it's published it's reviewed to see if that makes sense.
>> 
>>  
>> yes I want the things that you said . But where can I find this? In other words where rule writers put their classification's explain on?
>> Also I want some explain about ALL snort alerts consist : Type , mechanism , effect And its resource .
>> 
>> I have these two question . And I want reference for these. Can you help me?
>> 
>> Thanks
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20120821/dc118b7c/attachment.html>


More information about the Snort-users mailing list