Snort mailing list archives

Re: WEB-IIS %2E-asp access

From: Frank Knobbe <frank () knobbe us>
Date: Tue, 14 Dec 2004 08:25:27 -0600

On Tue, 2004-12-14 at 07:35, Patrick Marquetecken wrote:

I want to disable/hide WEB-IIS %2E-asp access so i put in my threshold.conf following rule:
suppress gen_id8, sig_id 972, track by_dst, ip xxx.xxx.xxx.xxx


Since that "WEB-IIS %2E-asp access" is a regular rule, the generator ID
has to be 1.

suppress gen_id 1, sig_id 972, track by_dst, ip xxx.xxx.xxx.xxx

Regards,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part

Current thread:

WEB-IIS %2E-asp access Patrick Marquetecken (Dec 14)
- Re: WEB-IIS %2E-asp access Frank Knobbe (Dec 14)