Re: Threshold question

[Russ Combs <rcombs () sourcefire com>]

Alexander,

You can only specify either source or dest IP in a single threshold, not
both.  But you could try putting the source IP in the rule and tracking that
rule by dest and so on.

Russ

On Thu, Oct 1, 2009 at 9:46 AM, Alexander Novokhatsky <
alex.ontario () gmail com> wrote:

> Hello snort-users,
>
> Is it possible to set up threshold for specific pair source IP and
> dest IP?
> So it should be something like track by_src&by_dest

> Thanks
> --
> Best regards,
>  Alexander                          mailto:alex.ontario () gmail com
>
>
>
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
> http://p.sf.net/sfu/devconf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-users%0ASnort-users>list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------
Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay 
ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
http://p.sf.net/sfu/devconf

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users