[Snort-users] RE: problem with suppress...

sekure sekure at ...11827...
Thu Jul 15 06:05:01 EDT 2004


You don't need the -o flag for suppression to work.  -o is used for
when you have "pass" rules.  Suppression and thresholding should work
without it.

Rule 384 is a very generic "ICMP Ping".  Is this the rule that keeps
triggering or are you trying to supperss ALL Ping events with that
statement?  The reason I ask is that there are many many ICMP Ping
signatures.  Are you absolutely sure that it is sig id 384 that keeps
showing and not other ping signatures?

On Thu, 15 Jul 2004 08:43:02 +1000, Graeme Rider
<graeme.rider at ...12106...> wrote:
> Tobias,
>        yes...l was not initially but then saw a reference to this flag in
> the 'pass' requirements...
> the suppress rule that l am using is in the local.rules file:
>        suppress gen_id 1,sig_id 384
> regards
> graeme

More information about the Snort-users mailing list