No subject

Thu Nov 23 16:36:19 EST 2017

to only with log, the others component of must
generate an alert... wich rule I must create?

2) Second Doubt (Established Connections)

I protect my host with snort, so I've done this rule

alert tcp HOST-B any -> HOST-A any (msg: "connection attempted";)

when HOST-A connect to HOST-B:139 for netbios share, the HOST-B response the
connection for establishing it, and snort generate an alert from it... I
need only snort to log HOST-B attemp to HOST-A not, just established
connection and data transfer.

How to solve this problem ?

More information about the Snort-users mailing list