[Snort-users] Event Suppression between specific Source and Destination

Joel Esler jesler at ...1935...
Fri Dec 14 10:36:34 EST 2012


On Dec 14, 2012, at 10:35 AM, Guido Hungerbuehler <guh at ...15642...> wrote:

> A pass rule would be without any effect because I run the sensor in alert-before-pass configuration.
> 
> Is there any other possibility?


Not at this time.

Why do you run in an alert before pass configuration?  That's the point of a pass rule.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20121214/6eb8eba9/attachment.html>


More information about the Snort-users mailing list