[Snort-users] Event supression problem

Zphosis De Extrodinaire zphosis at ...11562...
Sun Apr 4 21:33:04 EDT 2004


HI all,

I'm having a problem trying to suppress the event with sig_id 620, which 
happens to me the SCAN Proxy Attempt.

Here's the suppress line.

suppress gen_id 1, sig_id 620, track by dst, ip 10.10.10.111

The line is placed below Output plugin section on snort.conf.
Currently using snort v. 2.1.1

Any ideas why its failing?

regards,

Z.





More information about the Snort-users mailing list