Have you tested to see if this works?
J
On Tue, Jul 25, 2006 at 12:24:12PM -0400, Gentoo-Wally sent me:
On a related note then,
It might be a good idea to expand the suppression syntax to allow
joining 'track by_src' and 'track by_dst' in one statement.
I use a lot of pass rules and suppression statements to limit FP
without disabling the rule. I'm often reluctant to use a suppression
statement, because what I really want to suppress is an alert to a
specific address from a specific network, which I believe right now
requires requires a pass rule.
Thx,
Wally
On 7/25/06, Joel Esler <joel.esler@sourcefire.com> wrote:
Wally,
This is a good question. Thanks for asking.
Pass rules and Suppression are pretty much processed at the same time,
however, suppression does not require rule ordering, so it's preferred your
use Suppression.
J
On Tue, Jul 25, 2006 at 11:27:57AM -0400, Gentoo-Wally sent me:
Hi,
From a performance standpoint, is it better to use a pass rule or a
suppression statement to prevent an alert from triggering for a
spacific rule to/from a spacific IP/network?
Wally
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share
your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
+---------------------------------------------------------------------+
Joel Esler Senior Security Consultant 1-706-627-2101
Sourcefire Security for the /Real/ World -- http://www.sourcefire.com
Snort - Open Source Network IPS/IDS -- http://www.snort.org
GPG Key: http://demo.sourcefire.com/jesler.pgp.key
AIM:eslerjoel YMSG:eslerjoel Gtalk:eslerj
+---------------------------------------------------------------------+
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
+---------------------------------------------------------------------+
Joel Esler Senior Security Consultant 1-706-627-2101
Sourcefire Security for the /Real/ World -- http://www.sourcefire.com
Snort - Open Source Network IPS/IDS -- http://www.snort.org
GPG Key: http://demo.sourcefire.com/jesler.pgp.key
AIM:eslerjoel YMSG:eslerjoel Gtalk:eslerj
+---------------------------------------------------------------------+
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
