[Snort-users] Multiple IP addresses or use of variables in threshold.conf using SUPPRESS

Eric Hines eric.hines at ...8860...
Mon Feb 14 08:14:47 EST 2005

I am having trouble specifying more than one IP in a suppress line in the
threshold.conf. We've got to suppress 16 IP addresses and can't use a CIDR.
Does anyone know if its possible to 

A) Specify a variable which contains a [ ] of multiple Ips
B) Specify more than one IP separated by comma's in a single suppress line?

Best Regards,

Eric Hines, GCIA, CISSP
CEO, President, Chairman
Applied Watch Technologies, LLC
1134 N. Main St.
Algonquin, IL 60102
Tel: (877) 262-7593 x327
Fax: (877) 262-7593
Web: http://www.appliedwatch.com

More information about the Snort-users mailing list