[sniffer] False Positives

2006-02-23 Thread Kevin Rogers
So when I asked how I would send in false positives, someone mentioned that I should look up the appropriate log entry and send that in. That brings up another question. My log file is 270MB and climbing. I've never opened it cause it's too big. Do you have a reader for your log files? I

RE: [sniffer] False Positives

2006-02-23 Thread John Carter
A program like freeware Baregrep (http://www.baremetalsoft.com/baregrep/) might be helpful to you. Do you not regularly cycle your logs and submit them? John C -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kevin Rogers Sent: Thursday, February 23,

Re: [sniffer] False Positives

2006-02-23 Thread Pete McNeil
On Thursday, February 23, 2006, 5:48:55 AM, Kevin wrote: KR So when I asked how I would send in false positives, someone mentioned KR that I should look up the appropriate log entry and send that in. That KR brings up another question. My log file is 270MB and climbing. I've KR never opened it

[sniffer] When to go persistent

2006-02-23 Thread Goran Jovanovic
Hi, Is there any good rule of thumb, in terms of messages processed per minute/hour/day when you should move to a persistent instance of Sniffer? Thank you Goran Jovanovic Omega Network Solutions This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription

RE: [sniffer] When to go persistent

2006-02-23 Thread Colbeck, Andrew
Goran, I'd be interested in Pete's technical answer, too. The practical answer is that you should always go with the persistent instance of Message Sniffer. From reading Pete's previous screeds and monitoring the list here in the last year and from having my own troubles, it's pretty clear to me

Re: [sniffer] When to go persistent

2006-02-23 Thread Pete McNeil
On Thursday, February 23, 2006, 11:30:02 AM, Goran wrote: GJ Hi, GJ Is there any good rule of thumb, in terms of messages processed per GJ minute/hour/day when you should move to a persistent instance of GJ Sniffer? I would suggest using the persistent mode unless you have a reason not to. (In

RE: [sniffer] When to go persistent

2006-02-23 Thread Goran Jovanovic
Andrew, So when you went to persistent it lowered the stress on your already stressed hardware? And I see that Pete has responded as I write this with: Use it Well I will set it up and see how my system reacts. Goran Jovanovic Omega Network Solutions -Original Message- From: [EMAIL

Re: [sniffer] When to go persistent

2006-02-23 Thread Joe / Internet Specialists, LLC
I'm investigating the persistant mode and read the info on the web site. Can't make heads or tails of it. How do enable persistant mode on a Windows 2003 Server? The web site speaks hypothetically, but the information is not practical. From the message at

Re[2]: [sniffer] When to go persistent

2006-02-23 Thread Pete McNeil
On Thursday, February 23, 2006, 11:53:51 AM, LLC wrote: JISL I'm investigating the persistant mode and read the info on the web site. JISL Can't make heads or tails of it. JISL How do enable persistant mode on a Windows 2003 Server? The web site speaks JISL hypothetically, but the information

RE: Re[2]: [sniffer] When to go persistent

2006-02-23 Thread Goran Jovanovic
Pete, To run in persistent mode, simply launch an instance of SNF from the command line with the word persistent in place of the file to scan. licenseid.exe authentication persistent I am calling Sniffer from Declude. Could I just later my statement in my config file to include

Re[4]: [sniffer] When to go persistent

2006-02-23 Thread Pete McNeil
On Thursday, February 23, 2006, 12:59:24 PM, Goran wrote: GJ Pete, To run in persistent mode, simply launch an instance of SNF from the command line with the word persistent in place of the file to scan. licenseid.exe authentication persistent GJ I am calling Sniffer from Declude. Could

Re: [sniffer] What is this file

2006-02-23 Thread Pete McNeil
On Thursday, February 23, 2006, 1:07:07 PM, Goran wrote: GJ Pete, GJ I have seen a couple of times that the file GJ C:\External\Sniffer\my license-20060221071316x386D4931-2352.SVR GJ Is open and cannot be backed up. GJ What is this file? I assume that I do not need to be worried since the GJ

RE: [sniffer] What is this file

2006-02-23 Thread Goran Jovanovic
Thank you that is great. Goran Jovanovic Omega Network Solutions -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Thursday, February 23, 2006 3:08 PM To: Goran Jovanovic Subject: Re: [sniffer] What is this file On Thursday,

[sniffer] Running sniffer as a service

2006-02-23 Thread Ben Emmons
If you don't want to install the Windows Server 2003 Resource Kit you can use XYNTService (no installation or reboot required): 1. Download XYNTService (the homepage is here: http://www.codeproject.com/system/xyntservice.asp but you have to register to download it. If you prefer, its quicker