Can anyone please tell me what does initial values in a snort alert mean. E.g., what does "07/31-16:19:48.614462" mean in following alert

07/31-16:19:48.614462  [**] [1:86300000:1] 503 irc_bot_cmd ExampleRule XY .... [**] [Priority: 0] {TCP} ->
  • 2
    That looks like a timestamp: 31st July, at nearly 20 past 4 in the afternoon. – Matthew Aug 24 '16 at 9:29

Thats the time and date of the alert in the fastalert output format: MONTH/DAY-HOUR:MIN:SEC.MILIIS

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.