Revision 1.2, Tue May 13 00:27:48 2003 UTC (20 years, 11 months ago) by salo
Branch: MAIN
CVS Tags: pkgsrc-2009Q1-base, pkgsrc-2009Q1, pkgsrc-2008Q4-base, pkgsrc-2008Q4, pkgsrc-2008Q3-base, pkgsrc-2008Q3, pkgsrc-2008Q2-base, pkgsrc-2008Q2, pkgsrc-2008Q1-base, pkgsrc-2008Q1, pkgsrc-2007Q4-base, pkgsrc-2007Q4, pkgsrc-2007Q3-base, pkgsrc-2007Q3, pkgsrc-2007Q2-base, pkgsrc-2007Q2, pkgsrc-2007Q1-base, pkgsrc-2007Q1, pkgsrc-2006Q4-base, pkgsrc-2006Q4, pkgsrc-2006Q3-base, pkgsrc-2006Q3, pkgsrc-2006Q2-base, pkgsrc-2006Q2, pkgsrc-2006Q1-base, pkgsrc-2006Q1, pkgsrc-2005Q4-base, pkgsrc-2005Q4, pkgsrc-2005Q3-base, pkgsrc-2005Q3, pkgsrc-2005Q2-base, pkgsrc-2005Q2, pkgsrc-2005Q1-base, pkgsrc-2005Q1, pkgsrc-2004Q4-base, pkgsrc-2004Q4, pkgsrc-2004Q3-base, pkgsrc-2004Q3, pkgsrc-2004Q2-base, pkgsrc-2004Q2, pkgsrc-2004Q1-base, pkgsrc-2004Q1, pkgsrc-2003Q4-base, pkgsrc-2003Q4, cwrapper, cube-native-xorg-base, cube-native-xorg
Changes since 1.1: +3 -1 lines

Update to version 20021111.1.

Based on a patch sent by Hiramatsu Yoshifumi via PR pkg/21540.

Changes:

- fix all installed scripts
- simplify installation
- DESCR has 80 columns
- style nits

20021111.1:
===========
- alerts with original packet included now have both sets of ports and first
  set of IPs as links
- added -obfuscateip option to change the IP addresses in alerts to randomly
  (but consistently) chosen alternates (not presently available for database
  input)
- Updated parsing for Snort 1.9.0 full alert files
- new-style Spade reports now processed (Spade version 021008.1 and on)
- spp_portscan2 log files now processed (these entries are displayed somewhat
  prettified)
- updated linking to ICMP log files; this involved updates for new ICMP header
  format in Snort 1.9.0
- more robust recognition of non-packet alerts in different formats(these get
  ignored)
- clarified warning about unknown ICMP type text and added repeat warning
  suppression (you'll now only get a warning about a particular string twice)
- SnortSnarf will now ignore lines beginning with '#' between alerts, so you
  can use that to begin a comment