Re: Fwd: Re: Suppress alerts

[João Mota <joao () 3gnt net>]

Peter Rodger wrote:

> +-----------------------[suppression]------------------------------------------
> | gen-id=119    sig-id=4         
> tracking=dstip=0.0.0.0           mask=0.0.0.0
>
> | gen-id=122    sig-id=27        
> tracking=dstip=0.0.0.0           mask=0.0.0.0
>
> | gen-id=122    sig-id=19        
> tracking=dstip=0.0.0.0           mask=0.0.0.0
>
> *****************
>
> It looked like it reads the threshold.conf...
>  
Yes it is.

> Any help will be appreciated.  I am just too upset
> with that.
>  
Well... the gen/sid id pairs also appear to be right. My guess is that 
you are using Barnyard and reading old alert files. If you are, try 
using the bookmarking feature ( -w ). If you're not, and if you aren't 
mixing up output files I haven't got a clue. My sugestion in this later 
case is to use the linux banner command and write a big ascii-art HELP 
to the mailing list attaching all info possible:

-desired behaviour (yes again, I had to dig inside my mail trash to find 
your first message)
-snort.conf and comand line options used
-threshold.conf
-snort version
-pieces of output logs where it happens
-barnyard conf and comand line options used (if you are using it)
-all the paths to the files you are submiting

Good luck,
João

P.S. Don't reply to my address... i'm already receiving duplicate mails 
when you post to more than one mailing-list.


-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users