[Snort-users] Suppression vs Disablesid

Johnny Venter johnny.venter at ...15370...
Fri Sep 27 08:15:44 EDT 2013


Hello,

I have a question regarding suppression vs disablesid.conf.  I know that the packet is still processed with suppression, so cpu/mem/hd/net resources are still used. I would like to try using the disablesid.conf file, but do not know where to create it.  I figure it's arbitrary, so my other question is: where in the snort.conf file do I reference the disablesid.conf?

Thanks.




More information about the Snort-users mailing list