Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Users
[Top] [All Lists]

Re: [Snort-users] rules vs. suppress

Subject: Re: [Snort-users] rules vs. suppress
Date: Wed, 30 Mar 2005 16:48:11 -0500
Sorry for the delayed response. [insert standard excuse here] ;)

On Thu, Mar 24, Lee Clemens wrote:
That all makes sense, but a serious caveat...what suppress statement
wouldn't cause the rule to be pointless? (alert any any <> 10/8 any)

After having a better look at what you're trying to do, Marc Norton
and I both agree.  Making a broad suppression generalization does
nullify your rule statement - you do shutdown quite a bit of alerting
this way. Suppression is too specific for what you want.

Am I overlooking a simple solution for this? 

Your original 21 rules were better for what you're trying to do.  I'd
be happy to poke at your config with you. Send it to me off list if
you want.


-------------------------------------------------------
This SF.net email is sponsored by Demarc:
A global provider of Threat Management Solutions.
Download our HomeAdmin security software for free today!
http://www.demarc.com/info/Sentarus/hamr30
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

<Prev in Thread] Current Thread [Next in Thread>