[Snort-users] Multiple IP addresses or use of variables in threshold.conf using SUPPRESS
eric.hines at ...8860...
Mon Feb 14 08:14:47 EST 2005
I am having trouble specifying more than one IP in a suppress line in the
threshold.conf. We've got to suppress 16 IP addresses and can't use a CIDR.
Does anyone know if its possible to
A) Specify a variable which contains a [ ] of multiple Ips
B) Specify more than one IP separated by comma's in a single suppress line?
Eric Hines, GCIA, CISSP
CEO, President, Chairman
Applied Watch Technologies, LLC
1134 N. Main St.
Algonquin, IL 60102
Tel: (877) 262-7593 x327
Fax: (877) 262-7593
More information about the Snort-users