Snort mailing list archives
Re: threshold in rule definition and in threshold.conf
From: Jeremy Hewlett <jh () sourcefire com>
Date: Wed, 7 Jan 2004 14:03:02 -0500
On Wed, Jan 07, Nerijus Krukauskas wrote:
Let's say, I want to raise the count threshold. Will the line in threshold.conf (threshold gen_id 1, sig_id 2274, type threshold, track by_dst, count 10, seconds 60;) give me the desired result?
This should error, you can't apply multiple thresholds to the same sid.
In other words, will the custom made thresholds in threshold.conf override those in the definition of rules?
Thresholds in a rule will override other thresholds (ie: globals). ------------------------------------------------------- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities and atomic changes on 50+ platforms. Free Eval! http://www.perforce.com/perforce/loadprog.html _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- threshold in rule definition and in threshold.conf Nerijus Krukauskas (Jan 07)
- Re: threshold in rule definition and in threshold.conf Jeremy Hewlett (Jan 07)
- Re: threshold in rule definition and in threshold.conf Nerijus Krukauskas (Jan 12)
- Re: threshold in rule definition and in threshold.conf Jeremy Hewlett (Jan 07)