Help with Suppression

[Thanos Constantopoulos via Snort-devel <snort-devel () lists snort org>]

Hello All,

We are running Snort3.0.0-250 as IDS and we are trying to suppress
several IP addresses from the logs (global suppression from all
signatures). In order to perform this for specific IP addresses by
source we add the below under snort.lua

suppress =

{
{ gid = 119, sid = 228 },
{ gid = 119, sid 225 },
{ gid  = 0, sid =0, track = by_src, ip = '10.10.10.10', ip = '192.168.10.10' },
}

My questions are:

- Is there a way to use additional suppresion rules to cover by_src
with the same gid and sid?
- Is there a way to use additional suppresion rules to cover by_src
and by_dst, to totally exluded a subnet or IP address?
_______________________________________________
Snort-devel mailing list
Snort-devel () lists snort org
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!