[Snort-users] Event supression problem

Nerijus Krukauskas nk99 at ...10637...
Mon Apr 5 00:08:02 EDT 2004


Zphosis De Extrodinaire wrote:
>> HI all,
>>
>> I'm having a problem trying to suppress the event with sig_id 620, 
>> which happens to me the SCAN Proxy Attempt.
>>
>> Here's the suppress line.
>>
>> suppress gen_id 1, sig_id 620, track by dst, ip 10.10.10.111

   Should be "by_dst", not "by dst". You forgot the underscore 
character ('_').

-- 
NK @ Vilnius
nk.tinkle.lt

"For three days after death hair and fingernails continue to grow but 
phone calls taper off." -- Johnny Carson




More information about the Snort-users mailing list