OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: [snort] Spurious ALERT msgs in syslog
From: Martin Roesch (roeschhiverworld.com)
Date: Mon Mar 06 2000 - 16:01:39 CST

Erich Meier wrote:
>
> Feb 9 14:02:00 <SNORTHOST> snort[15126]: ALERT: W.X.Y.Z:1624 -> A.B.C.D:80
>
> This bug seems to be triggered by "session" keyword. When using rules like
> log tcp any any <> $INTERNAL 23 (session: all;)
> the packets are logged by the output plugins and reported as alerts like shown
> above. No session file is created, though.
>
> It seems, that the syslog_alert output plugin and the log.c standard mechanism
> do not work together very well.
>
> Can anyone confirm this?

This is caused by the complete suckage that is the output plugin system
in 1.6-beta10.2. I've completely rewritten it and it'll work much
better now. Stay tuned for the beta 11 announcement coming later
today.... 

-- 
Martin Roesch                      <roeschhiverworld.com>
Director of Forensic Systems     http://www.hiverworld.com
Hiverworld, Inc.               Enterprise Network Security
Network Forensics, Intrusion Detection and Risk Assessment