Request for configuration assistance
David Melczer via Snort-users <[email protected]> Thu, 23 Oct 2025 16:46:07 +0000
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <BY5PR10MB380984AC25DB918B21B97588A1F0A@BY5PR10MB3809.namprd10.prod.outlook.com> |
--===============3330341665658452132==
Content-Language: en-US
Content-Type: multipart/related;
boundary="_007_BY5PR10MB380984AC25DB918B21B97588A1F0ABY5PR10MB3809namp_";
type="multipart/alternative"
--_007_BY5PR10MB380984AC25DB918B21B97588A1F0ABY5PR10MB3809namp_
Content-Type: multipart/alternative;
boundary="_000_BY5PR10MB380984AC25DB918B21B97588A1F0ABY5PR10MB3809namp_"
--_000_BY5PR10MB380984AC25DB918B21B97588A1F0ABY5PR10MB3809namp_
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Good day.
We have a Snort3 sensor running 3.9.6.0 with the ETOPEN ruleset. The senso=
r runs on Debian 13, if that is relevant. Every time we go to image one of=
our laptops, we get several hundred ET alerts despite the fact that I have=
what I believe is the proper suppression rules set in SNORT.LUA (the IP ad=
dress of the machine generating these alerts is 172.19.8.25). Here is what=
I believe to be a relevant clip:
--------------------------------------------------------------------------
-- 6. configure filters
---------------------------------------------------------------------------
include 'et_thresholds.lua'
-- below are examples of filters
-- each table is a list of records
suppress =3D
{
-- don't want to any of see these
{ track =3D 'by_src', ip =3D '172.19.8.25' },
{ track =3D 'by_dst', ip =3D '172.19.8.25' },
...
}
I've tried different syntax that I've seen online, including:
{ gid =3D 0, sid =3D 0, track =3D 'by_src', ip =3D '172.19.8.25' },
{ gid =3D 0, sid =3D 0, track =3D 'by_dst', ip =3D '172.19.8.25' },
It would appear though that nothing I do suppresses error messages from thi=
s IP...
Does anyone have any idea how I might be able to accomplish this?
Thank you very much in advance for any assistance you can provide.
-Dave
David Z. Melczer | Director of Information Technology
Greenbaum, Rowe, Smith & Davis LLP
Delivery: 99 Wood Avenue South | Iselin, NJ | 08830
Mailing: P.O. Box 5600 | Woodbridge, NJ | 07095
T: 732.476.3284 | F: 732.476.3285 | vCard<http://www.greenbaumlaw.com/v=
card-1999.vcf>
[cid:[email protected]]
greenbaumlaw.com<http://www.greenbaumlaw.com/>
[cid:[email protected]]<https://www.linkedin.com/company/green=
baum-rowe-smith-&-davis-llp?trk=3Dtop_nav_home>
[cid:[email protected]]<https://twitter.com/greenbaumlaw>
[cid:[email protected]]<https://www.facebook.com/greenbaumlaw?=
fref=3Dts&ref=3Dbr_tf>
Disclaimer
The information contained in this communication from the sender is confiden=
tial. It is intended solely for use by the recipient and others authorized =
to receive it. If you are not the recipient, you are hereby notified that a=
ny disclosure, copying, distribution or taking action in relation of the co=
ntents of this information is strictly prohibited and may be unlawful.
This email has been scanned for viruses and malware, and may have been auto=
matically archived by Mimecast Ltd, an innovator in Software as a Service (=
SaaS) for business. Providing a safer and more useful place for your human =
generated data. Specializing in; Security, archiving and compliance. To fin=
d out more visit the Mimecast website.
--_000_BY5PR10MB380984AC25DB918B21B97588A1F0ABY5PR10MB3809namp_
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<html><head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
=09{font-family:"Cambria Math";
=09panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
=09{font-family:Aptos;}
@font-face
=09{font-family:"Arial Narrow";
=09panose-1:2 11 6 6 2 2 2 3 2 4;}
@font-face
=09{font-family:"Univers LT Std 57 Cn";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
=09{margin:0in;
=09font-size:12.0pt;
=09font-family:"Aptos",sans-serif;
=09mso-ligatures:standardcontextual;}
span.EmailStyle17
=09{mso-style-type:personal-compose;
=09font-family:"Aptos",sans-serif;
=09color:windowtext;}
.MsoChpDefault
=09{mso-style-type:export-only;}
@page WordSection1
=09{size:8.5in 11.0in;
=09margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
=09{page:WordSection1;}
--></style>
<style type=3D"text/css">.style1 {font-family: "Times New Roman";}</style><=
/head><body lang=3D"EN-US" link=3D"#467886" vlink=3D"#96607D" style=3D"word=
-wrap:break-word">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">Good day.<o:p></o:p=
></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></=
span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">We have a Snort3 se=
nsor running 3.9.6.0 with the ETOPEN ruleset. The sensor runs on Debi=
an 13, if that is relevant. Every time we go to image one of our lapt=
ops, we get several hundred ET alerts despite
the fact that I have what I believe is the proper suppression rules set in=
SNORT.LUA (the IP address of the machine generating these alerts is 172.19=
.8.25). Here is what I believe to be a relevant clip:<o:p></o:p></spa=
n></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></=
span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New"">----------------------------------------------------------=
----------------<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New"">-- 6. configure filters<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New"">----------------------------------------------------------=
-----------------<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New""><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New"">include 'et_thresholds.lua'<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New""><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New"">-- below are examples of filters<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New"">-- each table is a list of records<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New""><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New"">suppress =3D<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New"">{<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New""> -- don't want to any of see these<o:p><=
/o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New"">
<span style=3D"background:yellow;mso-highlight:yellow">{ track =3D 'by_src'=
, ip =3D '172.19.8.25' },<o:p></o:p></span></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New";background:yellow;mso-highlight:yellow"> =
{ track =3D 'by_dst', ip =3D '172.19.8.25' },</span><span style=3D"font-siz=
e:11.0pt;font-family:"Courier New""><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New"">…<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New"">}<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></=
span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">I’ve tried di=
fferent syntax that I’ve seen online, including:<o:p></o:p></span></p=
>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></=
span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New"">
<span style=3D"background:yellow;mso-highlight:yellow">{ gid =3D 0, sid =3D=
0, track =3D 'by_src', ip =3D '172.19.8.25' },<o:p></o:p></span></span></p=
>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Co=
urier New";background:yellow;mso-highlight:yellow"> =
{ gid =3D 0, sid =3D 0, track =3D 'by_dst', ip =3D '172.19.8.25' },</span><=
span style=3D"font-size:11.0pt;font-family:"Courier New""><o:p></=
o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></=
span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">It would appear tho=
ugh that nothing I do suppresses error messages from this IP…<o:p></o=
:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></=
span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">Does anyone have an=
y idea how I might be able to accomplish this?<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></=
span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">Thank you very much=
in advance for any assistance you can provide.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></=
span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">-Dave<o:p></o:p></s=
pan></p>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></=
span></p>
<p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:"=
;Arial Narrow",sans-serif;color:#1D5183;mso-ligatures:none">David Z. M=
elczer
</span></b><span style=3D"font-size:11.0pt;font-family:"Univers LT Std=
57 Cn";color:#538135;mso-ligatures:none">|</span><span style=3D"font-=
size:11.0pt;font-family:"Arial Narrow",sans-serif;color:#1F497D;m=
so-ligatures:none">
</span><span style=3D"font-size:9.0pt;font-family:"Arial Narrow",=
sans-serif;color:#1F497D;mso-ligatures:none">Director of Information Techno=
logy</span><i><span style=3D"font-size:11.0pt;font-family:"Arial Narro=
w",sans-serif;color:#1F497D;mso-ligatures:none"><o:p></o:p></span></i>=
</p>
<p class=3D"MsoNormal" style=3D"line-height:11.5pt;mso-line-height-rule:exa=
ctly"><b><span style=3D"font-size:3.0pt;font-family:"Arial Narrow"=
;,sans-serif;color:#1F497D;mso-ligatures:none"><o:p> </o:p></span></b>=
</p>
<p class=3D"MsoNormal" style=3D"line-height:11.5pt;mso-line-height-rule:exa=
ctly"><b><span style=3D"font-size:10.0pt;font-family:"Arial Narrow&quo=
t;,sans-serif;color:#1F497D;mso-ligatures:none">Greenbaum, Rowe, Smith &=
; Davis LLP<o:p></o:p></span></b></p>
<p class=3D"MsoNormal" style=3D"line-height:11.5pt;mso-line-height-rule:exa=
ctly"><span style=3D"font-size:10.0pt;font-family:"Arial Narrow",=
sans-serif;color:#1F497D;mso-ligatures:none">Delivery: 99 Wood Avenue South
</span><span style=3D"font-size:10.0pt;font-family:"Univers LT Std 57 =
Cn";color:#538135;mso-ligatures:none">|</span><span style=3D"font-size=
:10.0pt;font-family:"Arial Narrow",sans-serif;color:#1F497D;mso-l=
igatures:none"> Iselin, NJ
</span><span style=3D"font-size:10.0pt;font-family:"Arial Narrow"=
,sans-serif;color:#538135;mso-ligatures:none">|</span><span style=3D"font-s=
ize:10.0pt;font-family:"Arial Narrow",sans-serif;color:#1F497D;ms=
o-ligatures:none"> 08830<o:p></o:p></span></p>
<p class=3D"MsoNormal" style=3D"line-height:11.5pt;mso-line-height-rule:exa=
ctly"><span style=3D"font-size:10.0pt;font-family:"Arial Narrow",=
sans-serif;color:#1F497D;mso-ligatures:none">Mailing: P.O. Box 5600
</span><span style=3D"font-size:10.0pt;font-family:"Arial Narrow"=
,sans-serif;color:#538135;mso-ligatures:none">|</span><span style=3D"font-s=
ize:10.0pt;font-family:"Arial Narrow",sans-serif;color:#1F497D;ms=
o-ligatures:none"> Woodbridge, NJ
</span><span style=3D"font-size:10.0pt;font-family:"Arial Narrow"=
,sans-serif;color:#538135;mso-ligatures:none">|</span><span style=3D"font-s=
ize:10.0pt;font-family:"Arial Narrow",sans-serif;color:#1F497D;ms=
o-ligatures:none"> 07095<o:p></o:p></span></p>
<p class=3D"MsoNormal" style=3D"line-height:11.5pt;mso-line-height-rule:exa=
ctly"><span style=3D"font-size:10.0pt;font-family:"Arial Narrow",=
sans-serif;color:#1F497D;mso-ligatures:none">T:</span><span style=3D"font-s=
ize:11.0pt;color:#1F497D;mso-ligatures:none">
</span><span style=3D"font-size:10.0pt;font-family:"Arial Narrow"=
,sans-serif;color:#1F497D;mso-ligatures:none">732.476.3284</span><span styl=
e=3D"font-size:11.0pt;color:#1F497D;mso-ligatures:none">
</span><span style=3D"font-size:10.0pt;font-family:"Arial Narrow"=
,sans-serif;color:#1F497D;mso-ligatures:none"> </span><span style=3D"f=
ont-size:10.0pt;font-family:"Arial Narrow",sans-serif;color:#5381=
35;mso-ligatures:none">|
</span><span style=3D"font-size:10.0pt;font-family:"Arial Narrow"=
,sans-serif;color:#1F497D;mso-ligatures:none"> F:</span><span style=3D=
"font-size:11.0pt;color:#1F497D;mso-ligatures:none">
</span><span style=3D"font-size:10.0pt;font-family:"Arial Narrow"=
,sans-serif;color:#1F497D;mso-ligatures:none">732.476.3285
</span><span style=3D"font-size:10.0pt;font-family:"Arial Narrow"=
,sans-serif;color:#538135;mso-ligatures:none">|
</span><span style=3D"font-size:10.0pt;font-family:"Arial Narrow"=
,sans-serif;color:#1D5183;mso-ligatures:none"> </span><span style=3D"f=
ont-size:11.0pt;color:#1F497D;mso-ligatures:none"><a href=3D"http://www.gre=
enbaumlaw.com/vcard-1999.vcf"><span style=3D"font-size:10.0pt;font-family:&=
quot;Arial Narrow",sans-serif;color:#1D5183">vCard</span></a></span><s=
pan style=3D"font-size:10.0pt;font-family:"Arial Narrow",sans-ser=
if;color:#1F497D;mso-ligatures:none"><o:p></o:p></span></p>
<p class=3D"MsoNormal" style=3D"line-height:10.0pt;mso-line-height-rule:exa=
ctly"><span style=3D"font-size:4.0pt;font-family:"Arial Narrow",s=
ans-serif;color:#1D5183;mso-ligatures:none"><o:p> </o:p></span></p>
<p class=3D"MsoNormal" style=3D"mso-line-height-alt:.3pt"><span style=3D"fo=
nt-size:9.0pt;font-family:"Arial Narrow",sans-serif;color:#1F497D=
"><img border=3D"0" width=3D"188" height=3D"62" style=3D"width:1.9583in;hei=
ght:.6458in" id=3D"Picture_x0020_1" src=3D"cid:[email protected]=
30"><span style=3D"mso-ligatures:none"><o:p></o:p></span></span></p>
<table class=3D"MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpadding=
=3D"0" style=3D"margin-left:.7pt;border-collapse:collapse">
<tbody>
<tr style=3D"height:.2in">
<td width=3D"144" style=3D"width:1.5in;padding:0in .7pt 0in .7pt;height:.2i=
n">
<p class=3D"MsoNormal" style=3D"mso-line-height-alt:.3pt"><span style=3D"fo=
nt-size:11.0pt;color:#1F497D;mso-ligatures:none"><a href=3D"http://www.gree=
nbaumlaw.com/"><span style=3D"font-size:12.0pt;font-family:"Arial Narr=
ow",sans-serif;color:#ED7D31">greenbaumlaw.com</span></a></span><u><sp=
an style=3D"font-family:"Arial Narrow",sans-serif;color:#538135;m=
so-ligatures:none">
</span></u><span style=3D"font-family:"Arial Narrow",sans-serif;c=
olor:#538135;mso-ligatures:none"><o:p></o:p></span></p>
</td>
<td width=3D"18" style=3D"width:13.5pt;padding:0in .7pt 0in .7pt;height:.2i=
n">
<p class=3D"MsoNormal" style=3D"mso-line-height-alt:.3pt"><a href=3D"https:=
//www.linkedin.com/company/greenbaum-rowe-smith-&-davis-llp?trk=3Dtop_n=
av_home"><span style=3D"font-size:11.0pt;font-family:"Arial Narrow&quo=
t;,sans-serif;color:#1F497D;text-decoration:none"><img border=3D"0" width=
=3D"16" height=3D"16" style=3D"width:.1666in;height:.1666in" id=3D"Picture_=
x0020_2" src=3D"cid:[email protected]"></span></a><span style=
=3D"font-size:11.0pt;font-family:"Arial Narrow",sans-serif;color:=
#1D5183;mso-ligatures:none"><o:p></o:p></span></p>
</td>
<td width=3D"18" style=3D"width:13.5pt;padding:0in .7pt 0in .7pt;height:.2i=
n">
<p class=3D"MsoNormal" style=3D"mso-line-height-alt:.3pt"><a href=3D"https:=
//twitter.com/greenbaumlaw"><span style=3D"font-size:11.0pt;font-family:&qu=
ot;Arial Narrow",sans-serif;color:#1F497D;text-decoration:none"><img b=
order=3D"0" width=3D"16" height=3D"16" style=3D"width:.1666in;height:.1666i=
n" id=3D"Picture_x0020_3" src=3D"cid:[email protected]"></span=
></a><span style=3D"font-size:11.0pt;font-family:"Arial Narrow",s=
ans-serif;color:#1D5183;mso-ligatures:none"><o:p></o:p></span></p>
</td>
<td width=3D"18" style=3D"width:13.5pt;padding:0in .7pt 0in .7pt;height:.2i=
n">
<p class=3D"MsoNormal" style=3D"mso-line-height-alt:.3pt"><a href=3D"https:=
//www.facebook.com/greenbaumlaw?fref=3Dts&ref=3Dbr_tf"><span style=3D"f=
ont-size:11.0pt;font-family:"Arial Narrow",sans-serif;color:#1F49=
7D;text-decoration:none"><img border=3D"0" width=3D"16" height=3D"16" style=
=3D"width:.1666in;height:.1666in" id=3D"Picture_x0020_4" src=3D"cid:image00=
[email protected]"></span></a><span style=3D"font-size:11.0pt;font-fa=
mily:"Arial Narrow",sans-serif;color:#1D5183;mso-ligatures:none">=
<o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;mso-ligatures:none">=
<o:p> </o:p></span></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
</div>
<br><br><p style=3D"font-family: Verdana; font-size:10pt; color:#666666;"><=
b>Disclaimer</b></p><p style=3D"font-family: Verdana; font-size:8pt; color:=
#666666;">This e-mail (including any attachments) is intended only for the =
exclusive use of the individual to whom it is addressed. The information co=
ntained hereinafter may be proprietary, confidential, privileged and exempt=
from disclosure under applicable law. If the reader of this e-mail is not =
the intended recipient or agent responsible for delivering the message to t=
he intended recipient, the reader is hereby put on notice that any use, dis=
semination, distribution or copying of this communication is strictly prohi=
bited. If the reader has received this communication in error, please immed=
iately notify the sender by telephone (732-549-5600) or e-mail and delete a=
ll copies of this e-mail and any attachments. Thank you.</p></body></html>
--_000_BY5PR10MB380984AC25DB918B21B97588A1F0ABY5PR10MB3809namp_--
--_007_BY5PR10MB380984AC25DB918B21B97588A1F0ABY5PR10MB3809namp_
Content-Type: image/jpeg; name="image001.jpg"
Content-Description: image001.jpg
Content-Disposition: inline; filename="image001.jpg"; size=3448;
creation-date="Thu, 23 Oct 2025 16:46:07 GMT";
modification-date="Thu, 23 Oct 2025 16:46:07 GMT"
Content-ID: <[email protected]>
Content-Transfer-Encoding: base64
/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAoHBwkHBgoJCAkLCwoMDxkQDw4ODx4WFxIZJCAmJSMg
IyIoLTkwKCo2KyIjMkQyNjs9QEBAJjBGS0U+Sjk/QD3/2wBDAQsLCw8NDx0QEB09KSMpPT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT3/wAARCAA+ALwDASIA
AhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQA
AAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3
ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWm
p6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEA
AwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSEx
BhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElK
U1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3
uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD1TUNS
e1uIbW1t/tF3MCyoW2qqjqxNR2uqTjUUstQtVgllUtEySb0fHUdAQajTnxjIT/DYjH/fdPj1WOfV
YLe40+4hmbeYpJVXt1xg0AawIorlrW7v00a51W4u3fyPNEcOAFOGIBb1olvWsYbW5j1n7VKZEWaE
yKVbccHAHTGaAOpyPWjNc490L7UL1Z9WNklvJ5UcaSKpJwMsc9eTUMep3t5a6WsdyFkluXhllQAh
wueR9cUAdHeXH2W0mn27vKQvt9cCltZ/tNpDPt2+YgfHpkZrAu/tFnLf2Ul1LcQPYvMplwWQjIIz
6Goil7YeHrbUftspeNI2aDA8spwNuPp3oA6nI9aMisK/J+2SNeauLOEgeRHE4VunJbPXmq+l6pdX
TaPvm3CUzpIQOJNvANAHS5HrRkVzmrahdW8+rCGYqILRJIxj7rEnJpLtNRtZbDy9RkZ71/Ll3AFU
+XOVGOOlAHSZrLu9UuYtUFlaWQnfyvNJaUIAM4qPTzPa65cWMlzJcRCFZkaXllJJBGfSq93NcQ+L
c2tt9oc2YyvmBMDf15oAvWGqPc3k1pdWzW1xEofbvDBlPGQRWlXJvqFxFPqt/NGIL6GBI0tz8wVS
3Dbuhyf5VduorzSRaXH9oTz75kimSTG1g3GRxxg0Ab+RRmueTUblfD1wrSk30UzWoc9d5bCn8iDR
/aN0fDSfvf8ATjKLUuBzv3bScfQZoA6HNV7+6NnZTThd3lruxnGaxWuheaheRT6q1mlswijVZFUs
cAljnr1oS9kvvCd08siyyR74jIvR9rYz+VAHQqcgGnU1fuj6U6gAooooAxdQWay1qLUY4HnhaEwT
LEMuozkMB3FRLcPqXiCwnhtbqOGBJN7yxlB8wGOtb2BRigDnrfTbibwlc2RTy5pDLtV+OrEj86ak
zzJbQ2ukGG53KJWltwEjA+8c9/bFdHiq9/dpYWM1zICViQsQOpoAxVQadqF99q06S5SeXzoZI4RJ
nIGVPpyKVLe9kbR3ntljZJ3d0jUARqVOM4p8+o6vZ2Qv7iK0a3ADSQx7t6qfQ9CRmt1GDqGHIIyD
TAw9VtZ5tSuHjidkbTnjDAZBYngfWq0j3d5olvpTWNwlwyxxyMy/IoGMnd+HSumxVcNc/bmUpH9l
2Aqwb5i2eRj0pAYsQaw1e/eewmuJZpA0EqJuBXAG3P8ADiqtnb3llb6bczWkpNvNN5sUYyyhzwQO
4rZu9YSPRJdQtMSKhwN2QCd201pL6mmByt7Dd3zavMtnMizWqJCGHzPgnt2+lauoQSyXGkMkbERT
bnwPujYRzUmr67aaK9ut2ZM3DFU2Ju6DJJ9AB3rLuviB4ftEif7b5yS52mFS3Trn0pqLeyJckt2a
ccEg8TzT7G8o2qqH7Z3E4pBBL/wlLT+W3k/ZAu/tu3ZxUGh+LdM8QzyxafJKzxKGcOhXg1Le318u
rxWNiluS0JlLTFuxxjik01uNNPYp6tptzeX9+IUOJbJVRj90sr5xTrqefWFtLZLK5hKzJJM0qbVQ
KckZ7/hVq11K6XURY6lbxxySKXikhYlHA6jnoa1uopDOemsLj/hJgqxMbKSRbp37B1UjH4nBoSwu
B4lZDC32FZDdiTsXK7cfnzXQ1XvTcrasbJI3n42rIcA+tAGLsGnanfm6057mK4kEsUkcIk7AFT6c
ipZhcf8ACK3LXcMcMjKzeWigbFzwDjvitwcgZ6+1Udc40S7/ANymBeX7o+lOpq/dH0p1IAopM0tA
BRRRQAVBd20V5bS28wzHKpVhnsanqnqlrJe6bcQQyGKV0IRwcYPagDKW7vNARIdSH2mwBCJdKPmj
HYOP6il+ynUfEN/DLcTfZo44isaSFRkg85FNu31TU9NbT301opJVEckzSKYwO5Hc1esLKS21i8lK
/uXiiRGz12gg0wMOOCaXw7c6hLeXDXNuXEL+YRtCHAyOhzjnNaURa+1iSGWSQRyWMblUcrgk9Rjp
RFptyvhi8s2jAnlMu1d395iRz+NT2VlPFq/nyIBH9jSLOc/MDyKQGDFZpF4IuZo3k8x8qdzkgYk9
OlalzaHTL7TZ4Z52kmnEU2+QkSAg9ug5HaoV0+//AOEeudMa1w4YmOTeCsgL5+o49a1NUtZrmTTm
iXIhuVkfnouDQBzvxFuo9Nj02+kUyiOV4/J6CUMuGUntxmvNri2g07F9a28d9psxwhmzmM943wRh
vfv2r1nxlpt3q9lBa29hHeQsxMoaXy3Q4+Vlb1rkLHwbrOlSytaacZ45l2yQXVwnluP9oAc47V1U
ZqMTlqwbka/gX7BFrt7FYWK24NrFNv8ANZiQ3O0g9MV0sn/I4w/9eTf+hisfwloVzp2s3t5PYvbf
aIwDuuRL8wPQYHAA9a1r+O8h16K9trM3MYtzEQJApB3Z71hUactDemrRDVTjXtG/35f/AEGs6/8A
sa/bTc6lcS3ylihgZ8Q/3VwvA981pW9veXurRXt9ClulujLFCH3tlurE9OlU7a21Ky06506KyDu7
SFbgyDYwbJye+eaksfZ3c4vtKnmkYpe2uxhnjzANwOPU81Be3E8mn6teJLIq+ekUW1sYCkA4+pzV
q4027PhqzjgQfb7QI8ak/wAQ4Iz9M0650qYeFRYxKGnwpYZ6tuBbn86QEWtOiapD/aUk8enGLAeN
iqiTP8ZHI46dqmuIZIPC06SXIucIdkvXKZ4578d6mu3voL5iLY3dnJEF8tSuUbvnPUGqYspdP8I3
EMoCth2EYOQgLZCg+1MC/ckjWtNGSAUlyB34FKCf+EkYZOPsgOM/7dMv0uFv7G5gt2nWJXDBWAIy
Bjr9KjZ7xdTW8WwlZWt/LKB1yp3E+tIChfGwOp6mt7uMoVPKC7t33f4ce9b2nCYabbC4OZvKXfn1
xzUFjDMt/ezyxmNZvLKgnJ4XB/WtAdKAFooooAKSlooATFGBS0UAUdU1FdMtRKYpJmd1jSNMbnY9
AM1Uv/EMWnm3EttOTKgkcYAMS5Vcnn1YDir+oWEGpW3kXAYrkMCrFSpHQgjoarXGgWF0LYSxORbK
FX5zyvBw3qMgHn0oASTXII9WFgY5PNMix7scZZSw/QVBYeJ7XUdSmsYo5hNC8isGH9wgEj2OePoa
tvo9m+qDUWjY3C453HbkDAOOmcEjNMg0KwtdQa8ihIuGRkZ9x5DNuP60AU18VW76Jc6n9nmWKB9h
VioYnIHrx15B6VfTVI3ubOAowe7jaRcEEALjOT+IqFfDlgljc2gSQx3LBpCZCWJGMc9eMCp30mCW
e0mZpvNtARG/mHJBxkH1BwOtAFe216G41WWxWKVWj3gSEDa5TG4DvxuHWq1p4ttrzRrvUYrefy7Y
4ZOCT+Rx359Kvw6PZwX8t7HGwml3Zy5IGcbiB2JwM/So4tBsLe0mtYUeOOYKG2OQfl6EHsaALlld
C9sorhUKCVQwUkHH4jg1mReJYLmw1G5ggllFg7K6cAuBzuXnp1/KtKzsobGyS0tlKQxjaoz/AFqp
beHtOs4biK3g2JcR+VKAx+cc8n35PNAFy1ujc2Mdy0TRb037GIJA61QuPENvb+Hl1do5TCyhljAG
85OAK044kigWFBhFXaB7AYrPHh3Txp8VjJG8ttE/mLHK5YA84H0GelAEGpeKLPSxA0ySss8ayRso
6gkD9Acn2p95epqHhea6iVlSSMlQ3XGcZp8nh7Tp4LWKWAulrG0UW5j8qsNpH5Va/s63GmLYKpW3
WMRhQeijpzQBaUfKPpS4oHGBS0AJiloooA//2Q==
--_007_BY5PR10MB380984AC25DB918B21B97588A1F0ABY5PR10MB3809namp_
Content-Type: image/png; name="image002.png"
Content-Description: image002.png
Content-Disposition: inline; filename="image002.png"; size=687;
creation-date="Thu, 23 Oct 2025 16:46:07 GMT";
modification-date="Thu, 23 Oct 2025 16:46:07 GMT"
Content-ID: <[email protected]>
Content-Transfer-Encoding: base64
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAAlwSFlzAAAO
xAAADsQBlSsOGwAAABl0RVh0U29mdHdhcmUATWljcm9zb2Z0IE9mZmljZX/tNXEAAAIvSURBVDhP
jVPPS1RRGD3vvvue7zk/tEEtjcgakGxXtAtpGxIELaKFLQJXFbTvDwiKCGLatXXXJnAlRWQwTIsY
bZCUGYIRszIV7YczOvN+dO67k89poX7wPe733v3OPefc70ncfXsP0n6I0O9A4ONQYQhAJYIJCdN8
gsATBOAL41D9CANEabljkh262WCzFwI7XEuidzBZ7hvNOqSmzeZmgBMZB9fP9+L94h/kK5sEOpiR
YqCDJ4+c7saja1nkXlWR/7gCpJwDVcUAroXXPPXW0wKKpSXKSQDbNgVSR8D0mYKMXFPLbUUM4Ac4
mrSQTgqIzBGc683g8tkeTJc30OVIXMx2obj4Gy9Lq8RrgRGkTcKlbBq5G0O4/+ITfjYCPLgyiMqP
Pkh6cYr+bNR9bD33MFVaAzp1awzAwlPIjHCrjqanafq1bYw/nsbN0TMYHx3G1eE0ppQ/rdY2gFY/
Z8SAEGpQgMlCFe8+rOHCiK6Pp+gB/s1M2M5AeaTCtkyYnJOIgZq4gT44qU7Nbvehv+9hEEYm+3Tc
IYBNU9XaUkPFqZNGGNWm2T4bMQCdflPexJ1cHsXyCurdPbj9rIDZha9AOoHJuXWsVr7g89I6YKrr
JRABJQQ1qbm2Jea/1TA/qzaQW6OBuQW6raT3u5ip/sLMd9ZK/0BSi6FPErUar8RlzRc2Owf79aD4
3Kh0R/+Ip8WePBbXan/EYHl5Am5iDN6OdkU17F7HnvX/34TFQxrlv/pWz50W/4ytAAAAAElFTkSu
QmCC
--_007_BY5PR10MB380984AC25DB918B21B97588A1F0ABY5PR10MB3809namp_
Content-Type: image/png; name="image003.png"
Content-Description: image003.png
Content-Disposition: inline; filename="image003.png"; size=670;
creation-date="Thu, 23 Oct 2025 16:46:07 GMT";
modification-date="Thu, 23 Oct 2025 16:46:07 GMT"
Content-ID: <[email protected]>
Content-Transfer-Encoding: base64
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAAlwSFlzAAAO
xAAADsQBlSsOGwAAABl0RVh0U29mdHdhcmUATWljcm9zb2Z0IE9mZmljZX/tNXEAAAIeSURBVDhP
jVM9bxNBEH239+k7bEQwsaVIRiJCINr8ARoaSup01Ii/QEuDQEiIhopI/AEkitDRUIGQhQKhgAIn
WHICTvCd73y3y5szvjgxQpnCN56deftm5q1z9W16Vzn2feTaN0WO05ilFGDZMEZvOArWA0xyZYqC
Qes09TBaM09D1WrrDr3/FhtJ5Y9AC/78FToZwylp80QOciZOCB7Y00QpTOQyGPrT6pDsVYViIAxK
YwNo8J9LsG9jjYBZzMWN8zZuNhW+xAZbI2Ar1thPNdh7aRVAQoS1usKdjoun3yd4NSiw4lu4t+qW
X7Hurwy3uwlyy68KKwAB7E8MLgUWHl/xsNksEBO07R11/WZ3iM+DBO3WctnWMQaSNmbBkINY9hVu
tSrsajMfyEDVQjhMNtP6oxZcUthJDV4PMlyOgqpo5uynOd7tjVGL6rKPRQY2YzLx5z80Vr0E1y/4
8GaTYvqjbh/dGOicc6viYwwKUmp6wLWGjZQi8QSRJjc/+djHw08/sdRegW8rFKWQTrQgrArG3TTB
7kGOZ8MRvh6m2Nw5xPuDAkutNpr1CLkods6qSVE7yCiWl3vAi99jFFTZhJrwwrPoXDyD0PcXissW
lM1H8ZeSkG5ENdSjkMqj1glg8+HIudC25t6K4RoUz5xRkiAKOHUGys3wa9ETRuLrE5Rn7EvpU+tO
r9fbCML6usniarcLO/xHwHJd5Fm2/Qfh0dn7gsKPKAAAAABJRU5ErkJggg==
--_007_BY5PR10MB380984AC25DB918B21B97588A1F0ABY5PR10MB3809namp_
Content-Type: image/png; name="image004.png"
Content-Description: image004.png
Content-Disposition: inline; filename="image004.png"; size=637;
creation-date="Thu, 23 Oct 2025 16:46:07 GMT";
modification-date="Thu, 23 Oct 2025 16:46:07 GMT"
Content-ID: <[email protected]>
Content-Transfer-Encoding: base64
iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAAlwSFlzAAAO
xAAADsQBlSsOGwAAABl0RVh0U29mdHdhcmUATWljcm9zb2Z0IE9mZmljZX/tNXEAAAH9SURBVDhP
jVM9axRRFD3z5s3szm7WbDaODMYQMUvAJlXAysRCUlilFEyVPyCipZ1IsNDCKmCbNo1RLEQ0pFMs
VCK6MRgwYvyI7IqZ3Z15H943WeKuMyReePC+7rnnnnsvn7p077Ji7JZWMqeVwv+YZVkALVvpRS6g
71hSMK2NMz1kmNaa/v99M2fQ0rY7y+k609n8b7ZiRLECY4CXd8BpQ677JmUEvkc7HbnVFqiODGJy
4hT6Ci4ePnuHjU8/kc/xHo69p85THEsUPRdX585ifCzAt50GVp7X0I5EwiRJoWMpAEY0f4dNBH4J
1eFBLD16ieu376PUfwT9pXJKoRSAyXtkqIyLF8ZR8BycCAYwMz2Bt5t11H+1wDkJ0mWZAKPDFcyc
P42cyzF5ZgyVch+uzD9AJCQcxz44hVLRxev327i58ATX5s5h9cU6btxdRiMEfN8/PAUT4Uc9xJva
dyqhwIfNr/i43UT15JDpnZ7oBi2VghGY24wE84guh0fV8I8OwHUdSCkPZ2B+JFWiJaVKOtA4qq7S
HSiiqbGp9U69ifmFx3i1tgEv5yRA3V243weMGVV7h8io39htYfnpF8RRG8cDEi9jHkzP8N0wRLHg
7Q1HBzYZHtoHxyqwbRtC0Mj9k4IRVAgF/nlrazHvFWe1jAkgi2T2gFuMkzai9gdWac3JOlDOjQAA
AABJRU5ErkJggg==
--_007_BY5PR10MB380984AC25DB918B21B97588A1F0ABY5PR10MB3809namp_--
--===============3330341665658452132==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users
To unsubscribe, send an email to:
[email protected]
Please visit http://blog.snort.org to stay current on all the latest Snort news!
Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
--===============3330341665658452132==--