Snort mailing list archives
Re: SNort signature based filtering
From: Brian Caswell <bmc () snort org>
Date: Mon, 6 Feb 2006 19:57:08 -0500
On Feb 6, 2006, at 1:29 AM, mac subbu wrote:
Is it possible to filter out SID from a particular source in snort ??? And if possible how can we achieve that
suppress gen_id 1, sig_id 1852, track by_src, ip 10.1.1.54 See the manual for more examples. Brian ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- SNort signature based filtering mac subbu (Feb 05)
- Re: SNort signature based filtering Eric Hines (Feb 06)
- Re: SNort signature based filtering Andreas Östling (Feb 06)
- Re: SNort signature based filtering Brian Caswell (Feb 06)
- <Possible follow-ups>
- RE: SNort signature based filtering Michael Scheidell (Feb 06)
- Re: SNort signature based filtering Eric Hines (Feb 06)