Snort mailing list archives
Thresholding...
From: Tobias Rice <rice () up edu>
Date: Tue, 29 Jun 2004 10:05:03 -0700
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SnortUsers- I'm having some trouble getting thresholding to work as I desire. Let's say I have a rule 123456 that I want to NOT alert unless it happens more than twice in 1 second. If it happens more than twice in 1 second, log all subsequent alerts. I'm using this: threshold gen_id 1, sig_id 123456, type threshold, track by_src, count 2, seconds 1 ...and not getting the desired results. Can this scenario even be achieved? Thanks! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFA4aE/RJX8S0T0CkURAiMgAKCa0bJnxUVo6qV1rZwi1BWckVUbBACgqQ6S TxtS897XphyiIhmCaXcUPvc= =/e77 -----END PGP SIGNATURE----- ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training.Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Thresholding... Tobias Rice (Jun 29)