[Snort-sigs] Threshold in signatures

Roach4 ml at ...2320...
Wed Mar 17 05:38:06 EST 2004


Hi,

Could someone tell me if I need to enable the threshold.conf in the
snort.conf if I want to use the threshold feature in a signature?

The threshold part of the signature goes like this:
threshold: type limit, track by_src, count 500, seconds 60;


Thanks,

Roach4




More information about the Snort-sigs mailing list