Snort mailing list archives
Re: Multiple IP addresses or use of variables in threshold.conf using SUPPRESS
From: "Alex Butcher, ISC/ISYS" <Alex.Butcher () bristol ac uk>
Date: Tue, 15 Feb 2005 08:57:25 +0000
--On 14 February 2005 10:12 -0600 Eric Hines <eric.hines () appliedwatch com> wrote:
I am having trouble specifying more than one IP in a suppress line in the threshold.conf. We've got to suppress 16 IP addresses and can't use a CIDR. Does anyone know if its possible to A) Specify a variable which contains a [ ] of multiple Ips
Yup; see $AIM_SERVERS in the standard config for an example.
B) Specify more than one IP separated by comma's in a single suppress line?
It would seem not, from the manual (p.39ish) Best Regards, Alex. -- Alex Butcher: Security & Integrity, Personal Computer Systems Group Information Systems and Computing GPG Key ID: F9B27DC9 GPG Fingerprint: D62A DD83 A0B8 D174 49C4 2849 832D 6C72 F9B2 7DC9 ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Multiple IP addresses or use of variables in threshold.conf using SUPPRESS Eric Hines (Feb 14)
- RE: Multiple IP addresses or use of variables in threshold.conf using SUPPRESS Eric Hines (Feb 14)
- Re: Multiple IP addresses or use of variables in threshold.conf using SUPPRESS Alex Butcher, ISC/ISYS (Feb 15)