[Secureideas-base-devel] Re: [Snort-users] BASE 1.0.2 Unexpected Result /Inconsistency

[Joel E. <es...@kn...>]

I see that the problem is.  Can you submit this through=20
sourceforge.net/projects/secureideas as a bug so that we might be able=20=

to track/fix it?  Just copy and paste the email in there..

The reason is does that is because of the memory and filtering built=20
into the php code.  but you are right, it should be consistent.


Joel Esler
http://esler.is-a-geek.net
BASE Project Lead

On Mar 28, 2005, at 3:05 PM, Briggs, Bruce wrote:

>
> 1. select an alert Signature from the list.
>     you get a detail list of the alert packets
> 2. select Unique Addresses   Destination
>     you get a list of destination IP addrs and packet counts
> 3. select one of the addresses by clicking on the appropriate IP=20
> Address
> field
>     the value listed in Occurrences as Dest. is the count of all=20
> packets
> for that IP addr in the database, not those for   this specific alert
> Signature
> 4. select the count field.
>     the list displays only packets for the alert Signature for that IP
> addr
>
> I would expect consistency.
> a) I should get a count in 3. above of only packets from that IP addr
> matching the alert Signature, because that is the list that is=20
> displayed
> in 4.
> - or -
> b) in 4. above, I should get all packets matching that IP addr.
>
> My preference is for b).
>
> Bruce
>
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real=20
> users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_ide95&alloc_id=14396&op=3Dclick
> _______________________________________________
> Snort-users mailing list
> Sno...@li...
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=3Dsnort-users
>