Re: snort black list issue

[anton van der leun <anton () vanderleun com>]

I forgot …

 
Snort.conf:

 
# -- Begin GID:136 Based Rules -- #

 
drop ( msg: "REPUTATION_EVENT_BLACKLIST"; sid: 1; gid: 136; rev: 1; metadata: rule-type preproc ; 
classtype:bad-unknown; )

# alert ( msg: "REPUTATION_EVENT_WHITELIST"; sid: 2; gid: 136; rev: 1; metadata: rule-type preproc ; 
classtype:bad-unknown; )

 
Van: Hui cao [mailto:huica () cisco com] 
Verzonden: dinsdag 2 augustus 2016 16:43
Aan: anton van der leun <anton () vanderleun com>; Anton van der Leun <anton () triple-t-services nl>; snort-users () 
lists sourceforge net
CC: Alexander van der Leun <alex () triple-t-services nl>
Onderwerp: Re: AW: [Snort-users] snort black list issue

 
Hi Anton,

You have packets that are whitelisted. Have you checked that either IP is not in whitelist?

Do you have this defined in your rule?

drop ( msg: "REPUTATION_EVENT_BLACKLIST"; sid: 1; gid: 136; rev: 1; )

Best,
Hui.

On 08/02/2016 10:21 AM, anton van der leun wrote:

Reputation Preprocessor Statistics
Total Memory Allocated: 2257540
Number of packets blacklisted: 12
Number of packets whitelisted: 333

 

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!