[Snort-users] supress an IP address?

Harper, Patrick patrick.harper at ...11593...
Thu Oct 28 10:38:20 EDT 2004

Use a pass rule

-----Original Message-----
From: Larry Wichman [mailto:larrywichman at ...131...] 
Sent: Thursday, October 28, 2004 10:54 AM
To: Snorty S Snortman
Subject: [Snort-users] supress an IP address?

It does not look like you can do this in the
threshold.conf, but I would like to not see events
from a couple of IP addresses. Does anyone know of a
way to do this?


Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 

This Newsletter Sponsored by: Macrovision 
For reliable Linux application installations, use the industry's leading
setup authoring tool, InstallShield X. Learn more and evaluate 
today. http://clk.atdmt.com/MSI/go/ins0030000001msi/direct/01/
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

This electronic message, including any attachments, is confidential and intended solely for use of the intended recipient(s). This message may contain information that is privileged or otherwise protected from disclosure by applicable law. Any unauthorized disclosure, dissemination, use or reproduction is strictly prohibited. If you have received this message in error, please delete it and notify the sender immediately. 

More information about the Snort-users mailing list