Next: 4.15 Can priorities be
Up: 4 Rules and Alerts
Previous: 4.13 What about ``CGI
The Snort database plug-in only logs packet information into the database
when an alert is triggered by a rule (signature). Therefore, since alerts
generated by pre-preprocessors such as portscan and mini-fragment have no
corresponding rules, no packet information is logged beyond an entry
indicating their occurance. As a consequence, ACID cannot display any
packet-level (e.g. IP address) information for these alerts.
For these particular alerts, certain statistics may show zero unique IP
addresses, list the IP address as 'unknown', and will not list any packet
information when decoding the alert.
|
