[Snort-users] RE: problem with suppress...

Graeme Rider Graeme.Rider at ...12106...
Wed Jul 14 15:44:01 EDT 2004


Tobias,
	yes...l was not initially but then saw a reference to this flag in
the 'pass' requirements...
the suppress rule that l am using is in the local.rules file:
	suppress gen_id 1,sig_id 384
regards
graeme

-----Original Message-----
From: Tobias Rice [mailto:rice at ...7669...]
Sent: Thursday, 15 July 2004 12:02 AM
To: Graeme.Rider at ...12106...
Cc: snort-users at lists.sourceforge.net
Subject: problem with suppress...


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Are you using the "-o" flag to change the rule testing order to
Pass|Alert|Log?

Tobias
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFA9TzJRJX8S0T0CkURAgydAKCqv7UOaJ4eL4JOIPIW3jnGpPcTyQCfVWq6
yHLh601GO7lWufmFYuCRXIE=
=8xco
-----END PGP SIGNATURE-----

This email and any attachments may contain privileged and confidential information and are intended for the named addressee only. If you have received this e-mail in error, please notify the sender and delete this e-mail immediately. Any confidentiality, privilege or copyright is not waived or lost because this e-mail has been sent to you in error. It is your responsibility to check this e-mail and any attachments for viruses.  No warranty is made that this material is free from computer virus or any other defect or error.  Any loss/damage incurred by using this material is not the sender's responsibility.  The sender's entire liability will be limited to resupplying the material.




More information about the Snort-users mailing list