Snort mailing list archives
Re: Using suppress and syntax
From: Jason Wallace <jason.r.wallace () gmail com>
Date: Wed, 19 May 2010 20:36:45 -0400
Make sure you actually test that it functions. In previous versions of snort I had issues where snort did not error, but only one of my suppression was actually working. I think I had this issue early in the 2.8 branch, but I do not remember for sure. Wally On Wed, May 19, 2010 at 5:49 PM, Jefferson, Shawn <Shawn.Jefferson () bcferries com> wrote:
Hi, I’m doing this and it works: suppress gen_id 1, sig_id 2009955, track by_dst, ip [172.16.1.120,172.16.1.121] with Snort v.2.8.5.3 and I tested your suppress line and it worked for me as well (snort -T), no error message. ________________________________ From: Bill Pickens [mailto:wmpickens () gmail com] Sent: Wednesday, May 19, 2010 1:39 PM To: snort-users () lists sourceforge net Subject: [Snort-users] Using suppress and syntax Hello Everyone, I want to suppress a rule for a number of servers. Can I do that? I tried this an it gives me a parsing error: suppress gen_id 1, sig_id 469, track by_dst, ip [10.106.88.29,10.102.128.1,10.103.128.2,172.17.17.150] Also, What would be the proper syntax for the the last line show here: var ENT_DNS_SERVERS [10.101.1.1,10.103.1.2,10.105.3.4] var LOCAL_DNS_SERVERS [172.6.5.4,172.8.7.3,172.6.6.6] var DNS_SERVERS [$ENT_DNS_SERVERS,$LOCAL_DNS_SERVERS] <--- is this correct? snort doesn't complain Thanks Bill ------------------------------------------------------------------------------ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Using suppress and syntax Bill Pickens (May 19)
- Re: Using suppress and syntax Jefferson, Shawn (May 19)
- Re: Using suppress and syntax Jason Wallace (May 19)
- Re: Using suppress and syntax Bill Pickens (May 19)
- Re: Using suppress and syntax Joel Esler (May 20)
- Re: Using suppress and syntax Jefferson, Shawn (May 19)