Alert Suppresion Fail

["kritikus Araklidas" <kritikus31 () hotmail com>]

Hi everyone:

I have installed the snort 2.4.4 and after some week monitoring my network 
i'm still working on threads suppresion, so, some of them work fine but, 
some of then doesn't work like the following:

GEN:SID  1:16

Message  Sorry, no such sid-gen (1:16)

I configure on threshold.conf file the supression rule like:

suppress gen_id 1, sig_id 16, track by_src, ip X.X.X.0/24

But the suppresion doesn't work, the same thing happend with the GEN:SID 
with no information on snort database.

Any idea is appreciated.

Regards.

Chris.

_________________________________________________________________
Is your PC infected? Get a FREE online computer virus scan from McAfee® 
Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963



-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users