[Snort-users] thresholding

Doug Nordwall doug at ...10143...
Mon Sep 22 14:39:27 EDT 2003


sent off list, but snort version is 2.0.2


On Monday, September 22, 2003, at 02:19 PM, Chris Green wrote:

> Doug Nordwall <doug at ...10143...> writes:
>
>> I'm trying to suppress or threshold a particular rule with snort
>> 2.0.2. I've read the README.thresholding over and am attempting the
>> following
>>
>> rule is sid:483 (the cyberkit..i'm trying to squelch welchia a bit)
>>
>> I put in a line in snort.conf for rules in local-limits.rules
>>
>> the file itself says:
>> suppress gen_id 1, sig_id 483
>
> That should work. Mind sending your output of snort -V and your
> snort.conf?
> -- 
> Chris Green <cmg at ...1935...>
> Chicken's thinkin'
>
Doug Nordwall					doug at ...10143...
pgp fingerprint: 3CC7 B302 CB87 BCF3 F080  DF9D 43DF A123 D9D3 074E





More information about the Snort-users mailing list