[Snort-users] Event supression problem

Nerijus Krukauskas nk99 at ...10637...
Mon Apr 5 00:08:02 EDT 2004

Zphosis De Extrodinaire wrote:
>> HI all,
>> I'm having a problem trying to suppress the event with sig_id 620, 
>> which happens to me the SCAN Proxy Attempt.
>> Here's the suppress line.
>> suppress gen_id 1, sig_id 620, track by dst, ip

   Should be "by_dst", not "by dst". You forgot the underscore 
character ('_').

NK @ Vilnius

"For three days after death hair and fingernails continue to grow but 
phone calls taper off." -- Johnny Carson

More information about the Snort-users mailing list