Snort mailing list archives
Re: track by_src/dst
From: wkitty42 () windstream net
Date: Fri, 6 Nov 2015 21:29:29 -0500
On 11/06/2015 02:38 PM, Jefferson, Shawn wrote:
Hi, I believe you use brackets. [1.1.1.1,2.2.2.2] I don't think duplicate threshold lines work and throw an error, but I could be wrong, going from memory on that.
multiple lines with different single IP addresses each have been working fine over here with over 2000 entries in threshold.conf... many of them for akamai's mess of addresses ;) -- NOTE: No off-list assistance is given without prior approval. *Please keep mailing list traffic on the list* unless private contact is specifically requested and granted. ------------------------------------------------------------------------------ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- track by_src/dst Wei Chea Ang (Nov 05)
- Re: track by_src/dst wkitty42 (Nov 06)
- Re: track by_src/dst Wei Chea Ang (Nov 06)
- Re: track by_src/dst wkitty42 (Nov 06)
- Re: track by_src/dst Jefferson, Shawn (Nov 06)
- Re: track by_src/dst wkitty42 (Nov 06)
- Re: track by_src/dst Wei Chea Ang (Nov 06)
- Re: track by_src/dst wkitty42 (Nov 06)