<div dir="ltr"><p class="MsoNormal" style="font-size:12.8px"><b><span style="font-size:11pt;font-family:Calibri,sans-serif"><font color="#000000">Thanks to Al the problem was the following.</font></span></b></p><p class="MsoNormal" style="font-size:12.8px"><b><span style="font-size:11pt;font-family:Calibri,sans-serif"><font color="#000000"><br></font></span></b></p><p class="MsoNormal" style="font-size:12.8px"><b><span style="font-size:11pt;font-family:Calibri,sans-serif"><font color="#000000"># Reputation preprocessor. For more information see README.reputation<u></u><u></u></font></span></b></p><p class="MsoNormal" style="font-size:12.8px"><b><span style="font-size:11pt;font-family:Calibri,sans-serif"><font color="#000000">preprocessor reputation: \<u></u><u></u></font></span></b></p><p class="MsoNormal" style="font-size:12.8px"><b><span style="font-size:11pt;font-family:Calibri,sans-serif"><font color="#000000">   memcap 500, \<u></u><u></u></font></span></b></p><p class="MsoNormal" style="font-size:12.8px"><b><span style="font-size:11pt;font-family:Calibri,sans-serif"><font color="#000000">   priority whitelist, \</font><font color="#1f497d"><u></u><u></u></font></span></b></p><p class="MsoNormal" style="color:rgb(80,0,80);font-size:12.8px"><b><span style="font-size:11pt;font-family:Calibri,sans-serif;color:red">   nested_ip inner, \</span></b></p><p class="MsoNormal" style="color:rgb(80,0,80);font-size:12.8px"><b><span style="font-size:11pt;font-family:Calibri,sans-serif;color:red"><br></span></b></p><p class="MsoNormal" style="font-size:12.8px"><b><span style="font-size:11pt;font-family:Calibri,sans-serif"><font color="#000000">and needed to be</font></span></b></p><p class="MsoNormal" style="color:rgb(80,0,80);font-size:12.8px"><b><span style="font-size:11pt;font-family:Calibri,sans-serif;color:red"><br></span></b></p><p class="MsoNormal" style="font-size:12.8px"><b><span style="font-size:11pt;font-family:Calibri,sans-serif"><font color="#000000"># Reputation preprocessor. For more information see README.reputation<u></u><u></u></font></span></b></p><p class="MsoNormal" style="font-size:12.8px"><b><span style="font-size:11pt;font-family:Calibri,sans-serif"><font color="#000000">preprocessor reputation: \<u></u><u></u></font></span></b></p><p class="MsoNormal" style="font-size:12.8px"><b><span style="font-size:11pt;font-family:Calibri,sans-serif"><font color="#000000">   memcap 500, \<u></u><u></u></font></span></b></p><p class="MsoNormal" style="font-size:12.8px"><b><span style="font-size:11pt;font-family:Calibri,sans-serif"><font color="#000000">   priority whitelist, \</font><font color="#1f497d"><u></u><u></u></font></span></b></p><p class="MsoNormal" style="color:rgb(80,0,80);font-size:12.8px"><b><span style="font-size:11pt;font-family:Calibri,sans-serif;color:red">   nested_ip inner</span></b></p><div class="gmail_extra"><br></div><div class="gmail_extra">This is why it wasn't working. This didn't throw an error either. It required 2 lines until it was fixed because it was expecting a line continuation. Now I can use the default 1 line and it works.</div><div class="gmail_extra"><span style="font-family:Verdana,Geneva,sans-serif;font-size:13.3333px"><br></span></div><div class="gmail_extra"><span style="font-family:Verdana,Geneva,sans-serif;font-size:13.3333px">output unified2: filename /(path)/external1.u2</span><br></div><div class="gmail_extra"><span style="font-family:Verdana,Geneva,sans-serif;font-size:13.3333px">output unified2: filename /(path)/external1.u2</span><br></div><div class="gmail_extra"><span style="font-family:Verdana,Geneva,sans-serif;font-size:13.3333px"><br></span></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jan 25, 2016 at 10:21 AM, James Lay <span dir="ltr"><<a href="mailto:jlay@...13475..." target="_blank">jlay@...13475...</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div style="font-size:10pt;font-family:Verdana,Geneva,sans-serif">
<p>Try:</p>
<p>output unified2: filename /(path)/external1.u2</p><span class=""><font color="#888888">
<p>James</p></font></span><span class="">
<p>On 2016-01-25 08:52, Matthew White wrote:</p>
</span><blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<div dir="ltr"><span class="">
<div>Ran /(path)/snort -D -q -i eth3 -F /(path)/internalbf.filter -c /(path)/snort.conf.internal as root but still the same.</div>
<div>Also ran /(path)/snort -i eth3 -F /(path)/internalbf.filter -c /(path)/snort.conf.internal as root but still the same.</div>
<div> </div>
<div>Whats funny is that output alert_unified2: works fine.</div>
<div> </div>
<br>
</span><span class=""><div># unified2 <br># Recommended for most installs<br># output unified2: filename merged.log, limit 128, nostamp, mpls_event_types, vlan_event_types</div>
<div>output unified2: filename /(path)/external1-snort.log, limit 128, vlan_event_types<br>output alert_unified2: filename external1-snort.alert, limit 128</div>
</span></div>
<div class="gmail_extra"><br><div><div class="h5">
<div class="gmail_quote">On Sat, Jan 23, 2016 at 5:13 AM, James Lay <span><<a href="mailto:jlay@...13475..." target="_blank">jlay@...13475...</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><u></u>
<div>At this point I would test as root...otherwise please post a sanitized version of your complete snort.conf.<span><span style="color:rgb(136,136,136)"><br> <br> James</span></span>
<div>
<div><br> <br> On Fri, 2016-01-22 at 16:02 -0600, Matthew White wrote:
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">Tried your steps and still no .u2 file.</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">On Fri, Jan 22, 2016 at 2:59 PM, James Lay <<a href="mailto:jlay@...13475..." target="_blank">jlay@...13475...</a>> wrote:</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">Specify full path in your snort.conf:<br> <br> output unified2: filename /your/path/here/bleh.u2<br> <br> for testing remove the -D and -q from your command line.<br> <br> <span style="color:rgb(136,136,136)">James</span><br> </blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">On 2016-01-22 13:50, Matthew White wrote:<br> </blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">tried /usr/local/bin/snort -l /var/log/snort -D -q -i eth3 -F /etc/snort/internalbpf.filter -c /usr/src/snort-2.9.8.0/etc/snort.conf.internal -u snort still to no avail.</blockquote>
</blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px"></blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">On Fri, Jan 22, 2016 at 2:40 PM, Avery Rozar <<a href="mailto:avery.rozar@...846....17372..." target="_blank">avery.rozar@...17372...</a>> wrote:</blockquote>
</blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">Try adding "-l /var/log/snort" to step # 4.</blockquote>
</blockquote>
</blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px"></blockquote>
</blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">On Fri, Jan 22, 2016 at 3:33 PM, Matthew White <<a href="mailto:on3moda@...391...1827..." target="_blank">on3moda@...11827...</a>> wrote:</blockquote>
</blockquote>
</blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">1. The specified unified 2 log is not being created.<br> 2. Instead I get the snort.log.date (tcpdump) default and alerts.<br> 3. snort.conf - output unified2: filename internal.u2, limit 128, vlan_event_types<br> 4. running snort with sudo /usr/local/bin/snort -D -q -i eth3 -F /etc/snort/internalbpf.filter -c /usr/src/snort-2.9.8.0/etc/snort.conf.internal -u snort<br> 5. No errors or warnings when grep from /var/log/messages<br> 6. Running RHEL 6<br> 7. Installed and compiled from source<br> 8. Snort has rwx for /var/log/snort<br> 9. Deleted all logs<br> 10. Since this was installed from a tarball no file /etc/sysconfig/snort exists.<br> 11. tail -f alerts and snort.log are working great.<br> 12. Manually made /etc/sysconfig/snort with the following with no success as well.<br> <br> # /etc/sysconfig/snort<br> # $Id: <br> #### General Configuration<br> INTERFACE=eth2<br> CONF=/(Path to)/snort.conf<br> USER=snort<br> GROUP=snort<br> PASS_FIRST=0<br> #### Logging & Alerting<br> LOGDIR=/var/log/snort<br> ALERTMODE=fast<br> DUMP_APP=1<br> BINARY_LOG=1<br> NO_PACKET_LOG=0<br> PRINT_INTERFACE=0<br> <br> </blockquote>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">------------------------------------------------------------------------------<br> Site24x7 APM Insight: Get Deep Visibility into Application Performance<br> APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month<br> Monitor end-to-end web transactions and take corrective actions now<br> Troubleshoot faster and improve end-user experience. Signup Now!<br> <a style="display:none!important" href="http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140" target="_blank">http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140</a><br> _______________________________________________<br> Snort-users mailing list<br> <a href="mailto:Snort-users@lists.sourceforge.net" target="_blank">Snort-users@...8192...sourceforge.net</a><br> Go to this URL to change user options or unsubscribe:<br> <a href="https://lists.sourceforge.net/lists/listinfo/snort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br> Snort-users list archive:<br> <a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users" target="_blank">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a><br> <br> Please visit <a href="http://blog.snort.org" target="_blank">http://blog.snort.org</a> to stay current on all the latest Snort news!</blockquote>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px"></blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">------------------------------------------------------------------------------<br> Site24x7 APM Insight: Get Deep Visibility into Application Performance<br> APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month<br> Monitor end-to-end web transactions and take corrective actions now<br> Troubleshoot faster and improve end-user experience. Signup Now!<br> <a style="display:none!important" href="http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140" target="_blank">http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140</a></blockquote>
</blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px"></blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">_______________________________________________<br> Snort-users mailing list<br> <a href="mailto:Snort-users@lists.sourceforge.net" target="_blank">Snort-users@lists.sourceforge.net</a><br> Go to this URL to change user options or unsubscribe:<br> <a href="https://lists.sourceforge.net/lists/listinfo/snort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br> Snort-users list archive:<br> <a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users" target="_blank">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a><br> <br> Please visit <a href="http://blog.snort.org" target="_blank">http://blog.snort.org</a> to stay current on all the latest Snort news!</blockquote>
</blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px"><br>  <br> </blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px"> </blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px"><br> ------------------------------------------------------------------------------<br> Site24x7 APM Insight: Get Deep Visibility into Application Performance<br> APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month<br> Monitor end-to-end web transactions and take corrective actions now<br> Troubleshoot faster and improve end-user experience. Signup Now!<br> <a style="display:none!important" href="http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140" target="_blank">http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140</a><br> _______________________________________________<br> Snort-users mailing list<br> <a href="mailto:Snort-users@lists.sourceforge.net" target="_blank">Snort-users@lists.sourceforge.net</a><br> Go to this URL to change user options or unsubscribe:<br> <a href="https://lists.sourceforge.net/lists/listinfo/snort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br> Snort-users list archive:<br> <a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users" target="_blank">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a><br> <br> Please visit <a href="http://blog.snort.org" target="_blank">http://blog.snort.org</a> to stay current on all the latest Snort news!</blockquote>
</blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px"><br> </blockquote>
<blockquote type="cite" style="padding:0px 0.4em;border-left-color:rgb(16,16,255);border-left-width:2px;border-left-style:solid;margin:0px">
<pre>------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
<a style="display:none!important" href="http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140" target="_blank">http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140</a>
_______________________________________________
Snort-users mailing list
<a href="mailto:Snort-users@lists.sourceforge.net" target="_blank">Snort-users@lists.sourceforge.net</a>
Go to this URL to change user options or unsubscribe:
<a href="https://lists.sourceforge.net/lists/listinfo/snort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a>
Snort-users list archive:
<a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users" target="_blank">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a>

Please visit <a href="http://blog.snort.org" target="_blank">http://blog.snort.org</a> to stay current on all the latest Snort news!
</pre>
</blockquote>
<br> </div>
</div>
</div>
<br>------------------------------------------------------------------------------<br> Site24x7 APM Insight: Get Deep Visibility into Application Performance<br> APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month<br> Monitor end-to-end web transactions and take corrective actions now<br> Troubleshoot faster and improve end-user experience. Signup Now!<br> <a style="display:none!important" href="http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140" target="_blank">http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140</a><br>_______________________________________________<br> Snort-users mailing list<br> <a href="mailto:Snort-users@lists.sourceforge.net" target="_blank">Snort-users@lists.sourceforge.net</a><br> Go to this URL to change user options or unsubscribe:<br> <a href="https://lists.sourceforge.net/lists/listinfo/snort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br> Snort-users list archive:<br> <a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users" target="_blank">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a><br> <br> Please visit <a href="http://blog.snort.org" target="_blank">http://blog.snort.org</a> to stay current on all the latest Snort news!</blockquote>
</div>
</div></div></div>
</blockquote>
<p> </p>
<div> </div>
</div>
<br>------------------------------------------------------------------------------<br>
Site24x7 APM Insight: Get Deep Visibility into Application Performance<br>
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month<br>
Monitor end-to-end web transactions and take corrective actions now<br>
Troubleshoot faster and improve end-user experience. Signup Now!<br>
<a href="http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140" rel="noreferrer" target="_blank">http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140</a><br>_______________________________________________<br>
Snort-users mailing list<br>
<a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@...4626...ceforge.net</a><br>
Go to this URL to change user options or unsubscribe:<br>
<a href="https://lists.sourceforge.net/lists/listinfo/snort-users" rel="noreferrer" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br>
Snort-users list archive:<br>
<a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users" rel="noreferrer" target="_blank">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a><br>
<br>
Please visit <a href="http://blog.snort.org" rel="noreferrer" target="_blank">http://blog.snort.org</a> to stay current on all the latest Snort news!<br></blockquote></div><br></div></div>