Snort mailing list archives
Using suppress and syntax
From: Bill Pickens <wmpickens () gmail com>
Date: Wed, 19 May 2010 16:38:35 -0400
Hello Everyone, I want to suppress a rule for a number of servers. Can I do that? I tried this an it gives me a parsing error: suppress gen_id 1, sig_id 469, track by_dst, ip [10.106.88.29,10.102.128.1,10.103.128.2,172.17.17.150] Also, What would be the proper syntax for the the last line show here: var ENT_DNS_SERVERS [10.101.1.1,10.103.1.2,10.105.3.4] var LOCAL_DNS_SERVERS [172.6.5.4,172.8.7.3,172.6.6.6] var DNS_SERVERS [$ENT_DNS_SERVERS,$LOCAL_DNS_SERVERS] <--- is this correct? snort doesn't complain Thanks Bill
------------------------------------------------------------------------------
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Using suppress and syntax Bill Pickens (May 19)
- Re: Using suppress and syntax Jefferson, Shawn (May 19)
- Re: Using suppress and syntax Jason Wallace (May 19)
- Re: Using suppress and syntax Bill Pickens (May 19)
- Re: Using suppress and syntax Joel Esler (May 20)
- Re: Using suppress and syntax Jefferson, Shawn (May 19)