[Snort-users] http_inspect tuning issue

waldo kitty wkitty42 at ...14940...
Tue Jul 3 16:50:54 EDT 2012


On 7/3/2012 10:16, Joel Esler wrote:
> Suppress it.  That's the easiest way to get rid of the alert if you find it
> produces no actionable information for you.

does suppression prevent the processing for that alert from taking place or does 
it still take place and get dumped to nul?




More information about the Snort-users mailing list