next up previous contents
Next: High Performance Configuration Up: Network Intrusion Detection System Previous: NIDS Mode Output Options   Contents

Understanding Standard Alert Output

When Snort generates an alert message, it will usually look like the following:

	 
    [**] [116:56:1] (snort_decoder): T/TCP Detected [**]

The first number is the Generator ID, this tells the user what component of Snort generated this alert. For a list of GIDs, please read etc/generators in the Snort source. In this case, we know that this event came from the ``decode'' (116) component of Snort.

The second number is the Snort ID (sometimes referred to as Signature ID). For a list of preprocessor SIDs, please see etc/gen-msg.map. Rule-based SIDs are written directly into the rules with the sid option. In this case, 56 represents a T/TCP event.

The third number is the revision ID. This number is primarily used when writing signatures, as each rendition of the rule should increment this number with the rev option.



Eugene Misnik 2013-05-08