[Snort-users] SNort signature based filtering

Brian Caswell bmc at ...950...
Mon Feb 6 16:58:01 EST 2006


On Feb 6, 2006, at 1:29 AM, mac subbu wrote:
> Is it possible to filter out SID from a particular source in snort ???
> And if possible how can we achieve that

suppress gen_id 1, sig_id 1852, track by_src, ip 10.1.1.54

See the manual for more examples.

Brian





More information about the Snort-users mailing list