Jeremy Hewlett wrote:
You can look at <snort src>/etc/gen-msg.map for a listing of all the possible combinations you might see. The FAQ in section 4.32 also describes this.
Must be a different than this one: http://www.snort.org/docs/faq/1Q05/node55.html
I'm not sure if this is in the official manual or not(I'll have to look). If it isn't, I'll toss it over.
That'd be grand, I've been looking for a "SNORT for beginners"-doc :-) Thank You very much Martin