Config Issue - Suppress Module

fellsin via Snort-users <[email protected]> Tue, 14 Nov 2023 11:08:17 +0000

Newsgroups	gmane.comp.security.ids.snort.general
Message-ID	<w0JaWZHD4P50xjBEkosrGb03leHQF-p2edW32CTHMZolCHtcAG_GdfY5AdnPAbQDbdiEbPw6OtB199PcCgoXPuFJ5UxC-wB4dpLq1McPYDM=@proton.me>

Hello all,

Hope you're going all good.

As a fresh snort user, I am facing issues to set up suppress module trying to suppress a specific IP.

cat /usr/local/etc/snort/snort.lua
[...]

suppress =

{

{ track = 'by_src', ip = 'W.X.Y.Z' },

{ track = 'by_dst', ip = 'W.X.Y.Z' },

}

returns this

ERROR: /usr/local/etc/snort/snort.lua: threshold object cannot be created from the given parameters

ERROR: /usr/local/etc/snort/snort.lua: can't close suppress

Snort is happy with a single line...

I am running Snort3 (3.1.73.0) under Ubuntu 22.04.

Can anyone help me ?

Thanks,

All the best.
Fell

https://proton.me/

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette