[Snort-users] thresholding

Chris Green cmg at ...1935...
Mon Sep 22 14:20:24 EDT 2003

Doug Nordwall <doug at ...10143...> writes:

> I'm trying to suppress or threshold a particular rule with snort
> 2.0.2. I've read the README.thresholding over and am attempting the
> following
> rule is sid:483 (the cyberkit..i'm trying to squelch welchia a bit)
> I put in a line in snort.conf for rules in local-limits.rules
> the file itself says:
> suppress gen_id 1, sig_id 483

That should work. Mind sending your output of snort -V and your
Chris Green <cmg at ...1935...>
Chicken's thinkin'

More information about the Snort-users mailing list