[Snort-users] Alert Suppresion Fail

kritikus Araklidas kritikus31 at ...125...
Thu May 18 15:09:02 EDT 2006


Hi everyone:

I have installed the snort 2.4.4 and after some week monitoring my network 
i'm still working on threads suppresion, so, some of them work fine but, 
some of then doesn't work like the following:

GEN:SID  1:16

Message  Sorry, no such sid-gen (1:16)

I configure on threshold.conf file the supression rule like:

suppress gen_id 1, sig_id 16, track by_src, ip X.X.X.0/24

But the suppresion doesn't work, the same thing happend with the GEN:SID 
with no information on snort database.

Any idea is appreciated.

Regards.

Chris.

_________________________________________________________________
Is your PC infected? Get a FREE online computer virus scan from McAfee� 
Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963





More information about the Snort-users mailing list