![snort logo](/images/snort-logo.png)
Snort mailing list archives
RE: Threshold Suppression Not Working
From: "Ron Jenkins" <rjenkins () dibr net>
Date: Tue, 1 Feb 2005 06:53:35 -0600
Thanks... -----Original Message----- From: Alex Butcher, ISC/ISYS [mailto:Alex.Butcher () bristol ac uk] Sent: Tuesday, February 01, 2005 2:45 AM To: Ron Jenkins; snort-users Subject: Re: [Snort-users] Threshold Suppression Not Working --On 31 January 2005 11:11 -0600 Ron Jenkins <rjenkins () dibr net> wrote:
I am trying to suppress the below portscan alerts due to high volumes
of
alerts: * (portscan) Open Port * (portscan) TCP Portscan * (portscan) UDP Portscan * (portscan) TCP Portsweep * (portscan) UDP Portsweep I have added it to the threshold.conf file along with my other working alert suppressions. Below is the format for the above: * suppress gen_id 122, sig_id 3 * suppress gen_id 122, sig_id 19 * suppress gen_id 122, sig_id 27 Thess lines are not working, so I had to disable the preprocessor
within
snort.conf.
I don't think sfportscan-generated alerts can have threshold rules applied in 2.3.0. I'm going to try fixing this and I'll let the list know how I get on.
Ron Jenkins (MCNE, CNE6, MCP, CCNA, CCEA)
Best Regards, Alex. -- Alex Butcher: Security & Integrity, Personal Computer Systems Group Information Systems and Computing GPG Key ID: F9B27DC9 GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9 ------------------------------------------------------- This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting Tool for open source databases. Create drag-&-drop reports. Save time by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc. Download a FREE copy at http://www.intelliview.com/go/osdn_nl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Threshold Suppression Not Working Ron Jenkins (Jan 31)
- Re: Threshold Suppression Not Working Alex Butcher, ISC/ISYS (Feb 01)
- <Possible follow-ups>
- RE: Threshold Suppression Not Working Ron Jenkins (Feb 01)
- snort configuration in layer 2 Peggy Kam (Feb 01)
- Re: snort configuration in layer 2 Matt Kettler (Feb 01)
- threshold for alerts but not for logs? Peggy Kam (Mar 01)
- snort configuration in layer 2 Peggy Kam (Feb 01)