Threshold Suppression Not Working

["Ron Jenkins" <rjenkins () dibr net>]

I am trying to suppress the below portscan alerts due to high volumes of
alerts:

*       (portscan) Open Port
*       (portscan) TCP Portscan
*       (portscan) UDP Portscan
*       (portscan) TCP Portsweep
*       (portscan) UDP Portsweep

 

I have added it to the threshold.conf file along with my other working
alert suppressions.  Below is the format for the above:

*          suppress gen_id 122, sig_id 3

*          suppress gen_id 122, sig_id 19

*       suppress gen_id 122, sig_id 27

 

Thess lines are not working, so I had to disable the preprocessor within
snort.conf.

 

Any help would be great!

 

Thanks...

Ron Jenkins (MCNE, CNE6, MCP, CCNA, CCEA) 
Senior Architect 
Data Integrity, LLC 
"We Integrate People with Solutions" 
1724 Dallas Drive 
Suite 11 
Baton Rouge, La 70806 
Office. 225.927.8030 
Fax. 225.927.8033 
Cell225.931.1632 
Email. rjenkins () dibr net 
Web. www.dibr.net