Thresholding issues

["French, Jared" <jfrench539 () g rwu edu>]

I'm fairly new to snort and I've been trying to get thresholding working,
but haven't had any luck.  Not with individual rules or global rules.   I
added the following line to to threshold.conf and ran a rule update after:

event_filter gen_id 0, sig_id 0, type limit, track by_src, count 1, seconds
360

However, when I open up snorby and watch the logs I'll get the same alert
popping up many times in row either with the same timestamp or well within
the given 360 seconds.  My understanding is that this line should cause any
and all rules to fire only once every 360 seconds.  Is that incorrect or is
something possibly broken?

The same happens when I try to apply thresholds for individual rules such
as:

event_filter gen_id 1, sig_id 2012252, type limit, track by_src, count 1,
seconds 360

which is the emerging theat SHELLCODE Common 0a0a0a0a Heap Spray String
alert.

Just looking for some help / clarifcation.  Thanks!

------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the 
conversation now. http://goparallel.sourceforge.net/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!