Snort mailing list archives
Re: Threshold not working properly...
From: "Turnbough, Bradley E." <bturnbough () belcan com>
Date: Tue, 17 Nov 2015 16:36:39 +0000
Nevermind. The alerts are for different sensors, although the source and dest ip remain the same. ________________________________ From: Turnbough, Bradley E. Sent: Tuesday, November 17, 2015 10:06 AM To: snort-users () lists sourceforge net Subject: Threshold not working properly... I currently have this rule: event_filter gen_id 0, sig_id 0, type limit, track by_src, count 1, seconds 120 Is this syntax right? I am still getting alerts for events that have occurred less than 120 seconds apart, with the same source IP. Brad _____________________________________________________________ This e-mail transmission contains information that is confidential and may be privileged. It is intended only for the addressee(s) named above. If you receive this e-mail in error, please do not read, copy or disseminate it in any manner. If you are not the intended recipient, any disclosure, copying, distribution or use of the contents of this information is prohibited. Please reply to the message immediately by informing the sender that the message was misdirected. After replying, please erase it from your computer system. Your assistance in correcting this error is appreciated. ------------------------------------------------------------------------------ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Threshold not working properly... Turnbough, Bradley E. (Nov 17)
- Re: Threshold not working properly... Al Lewis (allewi) (Nov 17)
- Re: Threshold not working properly... Turnbough, Bradley E. (Nov 17)