Re: [Snort-users] Smb output

Frank Knobbe wrote:
> On Wed, 2004-07-21 at 17:13, Michael Sconzo wrote:
>>Ok, if you re-wrote smbclient (or at least the part that does the
>>WinPopUp stuff),
>
>
> No, no. I'm saying don't use smbclient at all. Have Snort populate a UDP
> packet and send it out.

That could be an option. But...

>>Then that gets into duplicating work etc ... but if you or somebody
>>else does it, I wouldn't complain either, and would probably use it.
>
> Heh... I don't even have much time at the moment to work on Snortsam. :(
> And since I don't use the SMB alert, there is no incentive for me
> either. Speaking of Snortsam, I'm doing something very similar there.

....no one is interested in rewriting this.

And one more thing. How many WinPopUp windows you gonna find after
you've been out for just one hour (e.g. having lunch)? Personally I
wouldn't want to deal with several hundred open windows at once. :)

--
http://nk.tinkle.lt/

The man who sets out to carry a cat by its tail learns something that
will always be useful and which never will grow dim or doubtful. --
Mark Twain.


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users