Re: SNort signature based filtering

[Andreas Östling <andreaso () it su se>]

On Monday 06 February 2006 15:26, Eric Hines wrote:
> Yes, its possible. Using the threshold.conf file, you can set up
> suppression for particular SIDs coming from or going to particular
> SRC or DST IP addresses respectively or ALL events matching a
> particular SID.

If you want to disable alerts for a rule regardless of the src and dst 
address, it's a waste of valuable resources to use suppression.
Here is a related document I wrote a couple of years ago that some 
people might find useful (it's not anything Oinkmaster-specific):

http://oinkmaster.sourceforge.net/avoiding_snort_alerts.txt

/Andreas


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users