[Snort-users] thresholding

Chris Green cmg at ...1935...
Mon Sep 22 14:20:24 EDT 2003


Doug Nordwall <doug at ...10143...> writes:

> I'm trying to suppress or threshold a particular rule with snort
> 2.0.2. I've read the README.thresholding over and am attempting the
> following
>
> rule is sid:483 (the cyberkit..i'm trying to squelch welchia a bit)
>
> I put in a line in snort.conf for rules in local-limits.rules
>
> the file itself says:
> suppress gen_id 1, sig_id 483

That should work. Mind sending your output of snort -V and your
snort.conf?
-- 
Chris Green <cmg at ...1935...>
Chicken's thinkin'




More information about the Snort-users mailing list