Snort mailing list archives
Re: SNort signature based filtering
From: Andreas Östling <andreaso () it su se>
Date: Mon, 6 Feb 2006 15:58:10 +0100
On Monday 06 February 2006 15:26, Eric Hines wrote:
Yes, its possible. Using the threshold.conf file, you can set up suppression for particular SIDs coming from or going to particular SRC or DST IP addresses respectively or ALL events matching a particular SID.
If you want to disable alerts for a rule regardless of the src and dst address, it's a waste of valuable resources to use suppression. Here is a related document I wrote a couple of years ago that some people might find useful (it's not anything Oinkmaster-specific): http://oinkmaster.sourceforge.net/avoiding_snort_alerts.txt /Andreas ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- SNort signature based filtering mac subbu (Feb 05)
- Re: SNort signature based filtering Eric Hines (Feb 06)
- Re: SNort signature based filtering Andreas Östling (Feb 06)
- Re: SNort signature based filtering Brian Caswell (Feb 06)
- <Possible follow-ups>
- RE: SNort signature based filtering Michael Scheidell (Feb 06)
- Re: SNort signature based filtering Eric Hines (Feb 06)