This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS Snort rule info in 7.500?

Which snort rule is this belonging too? 2101?

2009:10:20-00:12:07 fw snort[5550]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="CHAT IRC nick change" group="610" srcip="***.***.***.***" dstip="***.***.***.***" proto="6" srcport="39038" dstport="6667" sid="542" class="Potential Corporate Privacy Violation" priority="1" generator="1" msgid="0"

And where can I read about the rule?

This thread was automatically locked due to age.

Parents

0 BAlfson over 15 years ago

It says: sid="542"
And it says: reason="CHAT IRC nick change"

I didn't see that rule listed:
Astaro IPS Rules

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 15 years ago

It says: sid="542"
And it says: reason="CHAT IRC nick change"

I didn't see that rule listed:
Astaro IPS Rules

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 BrucekConvergent over 15 years ago in reply to BAlfson

Go here: SnortID.com - Search for SNORT ID's - Snort is a registered trademark of Sourcefire, Inc and enter the sid, the rule number in your case is 542.

A hint for that site: so you won't have to wade through all iteration of "542", prefix it with a 1: e.g. "1:542".
Cancel
Vote Up 0 Vote Down

Cancel