Re: Request for configuration assistance

"Al Lewis \(allewi\) via Snort-users" <[email protected]> Thu, 23 Oct 2025 17:31:23 +0000
Newsgroups gmane.comp.security.ids.snort.general
Message-ID <BL3PR11MB5715BDCC40DDF0C0A48BF638DAF0A@BL3PR11MB5715.namprd11.prod.outlook.com> 
--===============9090814833651025624==
Content-Language: en-US
Content-Type: multipart/related;
	boundary="_007_BL3PR11MB5715BDCC40DDF0C0A48BF638DAF0ABL3PR11MB5715namp_";
	type="multipart/alternative"

--_007_BL3PR11MB5715BDCC40DDF0C0A48BF638DAF0ABL3PR11MB5715namp_
Content-Type: multipart/alternative;
	boundary="_000_BL3PR11MB5715BDCC40DDF0C0A48BF638DAF0ABL3PR11MB5715namp_"

--_000_BL3PR11MB5715BDCC40DDF0C0A48BF638DAF0ABL3PR11MB5715namp_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Do you have a sample of the traffic that is alerting (with the suppression =
in place) that you can share?


Albert Lewis

Email: [email protected]<mailto:[email protected]>

________________________________
From: Snort-users <[email protected]> on behalf of David =
Melczer via Snort-users <[email protected]>
Sent: Thursday, October 23, 2025 12:46 PM
To: [email protected] <[email protected]>
Subject: [Snort-users] Request for configuration assistance


Good day.



We have a Snort3 sensor running 3.9.6.0 with the ETOPEN ruleset.  The senso=
r runs on Debian 13, if that is relevant.  Every time we go to image one of=
 our laptops, we get several hundred ET alerts despite the fact that I have=
 what I believe is the proper suppression rules set in SNORT.LUA (the IP ad=
dress of the machine generating these alerts is 172.19.8.25).  Here is what=
 I believe to be a relevant clip:



--------------------------------------------------------------------------

-- 6. configure filters

---------------------------------------------------------------------------



include 'et_thresholds.lua'



-- below are examples of filters

-- each table is a list of records



suppress =3D

{

    -- don't want to any of see these

    { track =3D 'by_src', ip =3D '172.19.8.25' },

    { track =3D 'by_dst', ip =3D '172.19.8.25' },

=85

}



I=92ve tried different syntax that I=92ve seen online, including:



    { gid =3D 0, sid =3D 0, track =3D 'by_src', ip =3D '172.19.8.25' },

    { gid =3D 0, sid =3D 0, track =3D 'by_dst', ip =3D '172.19.8.25' },



It would appear though that nothing I do suppresses error messages from thi=
s IP=85



Does anyone have any idea how I might be able to accomplish this?



Thank you very much in advance for any assistance you can provide.



-Dave



David Z. Melczer  | Director of Information Technology



Greenbaum, Rowe, Smith & Davis LLP

Delivery: 99 Wood Avenue South | Iselin, NJ | 08830

Mailing: P.O. Box 5600 | Woodbridge, NJ | 07095

T: 732.476.3284  |  F: 732.476.3285  |  vCard<http://www.greenbaumlaw.com/v=
card-1999.vcf>



[cid:[email protected]]

greenbaumlaw.com<http://www.greenbaumlaw.com/>

[cid:[email protected]]<https://www.linkedin.com/company/green=
baum-rowe-smith-&-davis-llp?trk=3Dtop_nav_home>

[cid:[email protected]]<https://twitter.com/greenbaumlaw>

[cid:[email protected]]<https://www.facebook.com/greenbaumlaw?=
fref=3Dts&ref=3Dbr_tf>







Disclaimer

This e-mail (including any attachments) is intended only for the exclusive =
use of the individual to whom it is addressed. The information contained he=
reinafter may be proprietary, confidential, privileged and exempt from disc=
losure under applicable law. If the reader of this e-mail is not the intend=
ed recipient or agent responsible for delivering the message to the intende=
d recipient, the reader is hereby put on notice that any use, dissemination=
, distribution or copying of this communication is strictly prohibited. If =
the reader has received this communication in error, please immediately not=
ify the sender by telephone (732-549-5600) or e-mail and delete all copies =
of this e-mail and any attachments. Thank you.

--_000_BL3PR11MB5715BDCC40DDF0C0A48BF638DAF0ABL3PR11MB5715namp_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div class=3D"elementToProof" style=3D"font-family: &quot;Courier New&quot;=
, monospace; font-size: 12pt; color: rgb(0, 0, 0);">
Do you have a sample of the traffic that is alerting (with the suppression =
in place) that you can share?</div>
<div class=3D"elementToProof" id=3D"Signature">
<div style=3D"font-family: &quot;Courier New&quot;, monospace; font-size: 1=
2pt; color: rgb(0, 0, 0);">
<br>
</div>
<p style=3D"line-height: normal; margin: 0px; font-family: Courier; font-si=
ze: 16px; color: rgb(30, 73, 125);">
<b>Albert Lewis</b></p>
<p style=3D"line-height: normal; margin: 0px; font-family: Courier; font-si=
ze: 15px; color: rgb(127, 127, 127);">
<span style=3D"font-size: 16px; color: rgb(153, 153, 153);">Email: </span><=
span style=3D"font-size: 16px; color: rgb(128, 27, 128);"><u><a style=3D"co=
lor: rgb(128, 27, 128); margin-top: 0px; margin-bottom: 0px;" href=3D"mailt=
o:[email protected]">[email protected]</a></u></span><span style=3D"font-size=
: 16px; color: rgb(79, 129, 189);">&nbsp;</span></p>
</div>
<div id=3D"appendonsend"></div>
<hr style=3D"display:inline-block;width:98%" tabindex=3D"-1">
<div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st=
yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> Snort-users &lt;snort=
[email protected]&gt; on behalf of David Melczer via Snort-use=
rs &lt;[email protected]&gt;<br>
<b>Sent:</b> Thursday, October 23, 2025 12:46 PM<br>
<b>To:</b> [email protected] &lt;[email protected]&gt;<=
br>
<b>Subject:</b> [Snort-users] Request for configuration assistance</font>
<div>&nbsp;</div>
</div>
<style>
<!--
@font-face
	{font-family:"Cambria Math"}
@font-face
	{font-family:Aptos}
@font-face
	{font-family:"Arial Narrow"}
@font-face
	{font-family:"Univers LT Std 57 Cn"}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
	{margin:0in;
	font-size:12.0pt;
	font-family:"Aptos",sans-serif}
span.x_EmailStyle17
	{font-family:"Aptos",sans-serif;
	color:windowtext}
.x_MsoChpDefault
	{}
@page WordSection1
	{margin:1.0in 1.0in 1.0in 1.0in}
div.x_WordSection1
	{}
-->
</style><style type=3D"text/css">
<!--
.x_style1
	{font-family:"Times New Roman"}
-->
</style>
<div lang=3D"EN-US" link=3D"#467886" vlink=3D"#96607D" style=3D"word-wrap:b=
reak-word">
<div class=3D"x_WordSection1">
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">Good day.</span><=
/p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">&nbsp;</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">We have a Snort3 =
sensor running 3.9.6.0 with the ETOPEN ruleset.&nbsp; The sensor runs on De=
bian 13, if that is relevant.&nbsp; Every time we go to image one of our la=
ptops, we get several hundred ET alerts despite
 the fact that I have what I believe is the proper suppression rules set in=
 SNORT.LUA (the IP address of the machine generating these alerts is 172.19=
.8.25).&nbsp; Here is what I believe to be a relevant clip:</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">&nbsp;</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">-------------------------------------------------------=
-------------------</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">-- 6. configure filters</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">-------------------------------------------------------=
--------------------</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">&nbsp;</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">include 'et_thresholds.lua'</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">&nbsp;</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">-- below are examples of filters</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">-- each table is a list of records</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">&nbsp;</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">suppress =3D</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">{</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">&nbsp;&nbsp;&nbsp; -- don't want to any of see these</s=
pan></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">&nbsp;&nbsp;&nbsp;
<span style=3D"background:yellow">{ track =3D 'by_src', ip =3D '172.19.8.25=
' },</span></span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;; background:yellow">&nbsp;&nbsp;&nbsp; { track =3D 'by_d=
st', ip =3D '172.19.8.25' },</span><span style=3D"font-size:11.0pt; font-fa=
mily:&quot;Courier New&quot;"></span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">=85</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">}</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">&nbsp;</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">I=92ve tried diff=
erent syntax that I=92ve seen online, including:</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">&nbsp;</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;">&nbsp;&nbsp;&nbsp;
<span style=3D"background:yellow">{ gid =3D 0, sid =3D 0, track =3D 'by_src=
', ip =3D '172.19.8.25' },</span></span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt; font-family:&quot=
;Courier New&quot;; background:yellow">&nbsp;&nbsp;&nbsp; { gid =3D 0, sid =
=3D 0, track =3D 'by_dst', ip =3D '172.19.8.25' },</span><span style=3D"fon=
t-size:11.0pt; font-family:&quot;Courier New&quot;"></span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">&nbsp;</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">It would appear t=
hough that nothing I do suppresses error messages from this IP=85</span></p=
>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">&nbsp;</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">Does anyone have =
any idea how I might be able to accomplish this?</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">&nbsp;</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">Thank you very mu=
ch in advance for any assistance you can provide.</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">&nbsp;</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">-Dave</span></p>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">&nbsp;</span></p>
<p class=3D"x_MsoNormal"><b><span style=3D"font-size:11.0pt; font-family:&q=
uot;Arial Narrow&quot;,sans-serif; color:#1D5183">David Z. Melczer&nbsp;
</span></b><span style=3D"font-size:11.0pt; font-family:&quot;Univers LT St=
d 57 Cn&quot;; color:#538135">|</span><span style=3D"font-size:11.0pt; font=
-family:&quot;Arial Narrow&quot;,sans-serif; color:#1F497D">
</span><span style=3D"font-size:9.0pt; font-family:&quot;Arial Narrow&quot;=
,sans-serif; color:#1F497D">Director of Information Technology</span><i><sp=
an style=3D"font-size:11.0pt; font-family:&quot;Arial Narrow&quot;,sans-ser=
if; color:#1F497D"></span></i></p>
<p class=3D"x_MsoNormal" style=3D"line-height:11.5pt"><b><span style=3D"fon=
t-size:3.0pt; font-family:&quot;Arial Narrow&quot;,sans-serif; color:#1F497=
D">&nbsp;</span></b></p>
<p class=3D"x_MsoNormal" style=3D"line-height:11.5pt"><b><span style=3D"fon=
t-size:10.0pt; font-family:&quot;Arial Narrow&quot;,sans-serif; color:#1F49=
7D">Greenbaum, Rowe, Smith &amp; Davis LLP</span></b></p>
<p class=3D"x_MsoNormal" style=3D"line-height:11.5pt"><span style=3D"font-s=
ize:10.0pt; font-family:&quot;Arial Narrow&quot;,sans-serif; color:#1F497D"=
>Delivery: 99 Wood Avenue South
</span><span style=3D"font-size:10.0pt; font-family:&quot;Univers LT Std 57=
 Cn&quot;; color:#538135">|</span><span style=3D"font-size:10.0pt; font-fam=
ily:&quot;Arial Narrow&quot;,sans-serif; color:#1F497D"> Iselin, NJ
</span><span style=3D"font-size:10.0pt; font-family:&quot;Arial Narrow&quot=
;,sans-serif; color:#538135">|</span><span style=3D"font-size:10.0pt; font-=
family:&quot;Arial Narrow&quot;,sans-serif; color:#1F497D"> 08830</span></p=
>
<p class=3D"x_MsoNormal" style=3D"line-height:11.5pt"><span style=3D"font-s=
ize:10.0pt; font-family:&quot;Arial Narrow&quot;,sans-serif; color:#1F497D"=
>Mailing: P.O. Box 5600
</span><span style=3D"font-size:10.0pt; font-family:&quot;Arial Narrow&quot=
;,sans-serif; color:#538135">|</span><span style=3D"font-size:10.0pt; font-=
family:&quot;Arial Narrow&quot;,sans-serif; color:#1F497D"> Woodbridge, NJ
</span><span style=3D"font-size:10.0pt; font-family:&quot;Arial Narrow&quot=
;,sans-serif; color:#538135">|</span><span style=3D"font-size:10.0pt; font-=
family:&quot;Arial Narrow&quot;,sans-serif; color:#1F497D"> 07095</span></p=
>
<p class=3D"x_MsoNormal" style=3D"line-height:11.5pt"><span style=3D"font-s=
ize:10.0pt; font-family:&quot;Arial Narrow&quot;,sans-serif; color:#1F497D"=
>T:</span><span style=3D"font-size:11.0pt; color:#1F497D">
</span><span style=3D"font-size:10.0pt; font-family:&quot;Arial Narrow&quot=
;,sans-serif; color:#1F497D">732.476.3284</span><span style=3D"font-size:11=
.0pt; color:#1F497D">
</span><span style=3D"font-size:10.0pt; font-family:&quot;Arial Narrow&quot=
;,sans-serif; color:#1F497D">&nbsp;</span><span style=3D"font-size:10.0pt; =
font-family:&quot;Arial Narrow&quot;,sans-serif; color:#538135">|
</span><span style=3D"font-size:10.0pt; font-family:&quot;Arial Narrow&quot=
;,sans-serif; color:#1F497D">&nbsp;F:</span><span style=3D"font-size:11.0pt=
; color:#1F497D">
</span><span style=3D"font-size:10.0pt; font-family:&quot;Arial Narrow&quot=
;,sans-serif; color:#1F497D">732.476.3285&nbsp;
</span><span style=3D"font-size:10.0pt; font-family:&quot;Arial Narrow&quot=
;,sans-serif; color:#538135">|
</span><span style=3D"font-size:10.0pt; font-family:&quot;Arial Narrow&quot=
;,sans-serif; color:#1D5183">&nbsp;</span><span style=3D"font-size:11.0pt; =
color:#1F497D"><a href=3D"http://www.greenbaumlaw.com/vcard-1999.vcf"><span=
 style=3D"font-size:10.0pt; font-family:&quot;Arial Narrow&quot;,sans-serif=
; color:#1D5183">vCard</span></a></span><span style=3D"font-size:10.0pt; fo=
nt-family:&quot;Arial Narrow&quot;,sans-serif; color:#1F497D"></span></p>
<p class=3D"x_MsoNormal" style=3D"line-height:10.0pt"><span style=3D"font-s=
ize:4.0pt; font-family:&quot;Arial Narrow&quot;,sans-serif; color:#1D5183">=
&nbsp;</span></p>
<p class=3D"x_MsoNormal" style=3D""><span style=3D"font-size:9.0pt; font-fa=
mily:&quot;Arial Narrow&quot;,sans-serif; color:#1F497D"><img border=3D"0" =
width=3D"188" height=3D"62" id=3D"x_Picture_x0020_1" style=3D"width:1.9583i=
n; height:.6458in" data-outlook-trace=3D"F:1|T:1" src=3D"cid:image001.jpg@0=
1DC441A.75522B30"><span style=3D""></span></span></p>
<table class=3D"x_MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpaddin=
g=3D"0" style=3D"margin-left:.7pt; border-collapse:collapse">
<tbody>
<tr style=3D"height:.2in">
<td width=3D"144" style=3D"width:1.5in; padding:0in .7pt 0in .7pt; height:.=
2in">
<p class=3D"x_MsoNormal" style=3D""><span style=3D"font-size:11.0pt; color:=
#1F497D"><a href=3D"http://www.greenbaumlaw.com/"><span style=3D"font-size:=
12.0pt; font-family:&quot;Arial Narrow&quot;,sans-serif; color:#ED7D31">gre=
enbaumlaw.com</span></a></span><u><span style=3D"font-family:&quot;Arial Na=
rrow&quot;,sans-serif; color:#538135">
</span></u><span style=3D"font-family:&quot;Arial Narrow&quot;,sans-serif; =
color:#538135"></span></p>
</td>
<td width=3D"18" style=3D"width:13.5pt; padding:0in .7pt 0in .7pt; height:.=
2in">
<p class=3D"x_MsoNormal" style=3D""><a href=3D"https://www.linkedin.com/com=
pany/greenbaum-rowe-smith-&amp;-davis-llp?trk=3Dtop_nav_home"><span style=
=3D"font-size:11.0pt; font-family:&quot;Arial Narrow&quot;,sans-serif; colo=
r:#1F497D; text-decoration:none"><img border=3D"0" width=3D"16" height=3D"1=
6" id=3D"x_Picture_x0020_2" style=3D"width:.1666in; height:.1666in" data-ou=
tlook-trace=3D"F:1|T:1" src=3D"cid:[email protected]"></span><=
/a><span style=3D"font-size:11.0pt; font-family:&quot;Arial Narrow&quot;,sa=
ns-serif; color:#1D5183"></span></p>
</td>
<td width=3D"18" style=3D"width:13.5pt; padding:0in .7pt 0in .7pt; height:.=
2in">
<p class=3D"x_MsoNormal" style=3D""><a href=3D"https://twitter.com/greenbau=
mlaw"><span style=3D"font-size:11.0pt; font-family:&quot;Arial Narrow&quot;=
,sans-serif; color:#1F497D; text-decoration:none"><img border=3D"0" width=
=3D"16" height=3D"16" id=3D"x_Picture_x0020_3" style=3D"width:.1666in; heig=
ht:.1666in" data-outlook-trace=3D"F:1|T:1" src=3D"cid:image003.png@01DC441A=
.75522B30"></span></a><span style=3D"font-size:11.0pt; font-family:&quot;Ar=
ial Narrow&quot;,sans-serif; color:#1D5183"></span></p>
</td>
<td width=3D"18" style=3D"width:13.5pt; padding:0in .7pt 0in .7pt; height:.=
2in">
<p class=3D"x_MsoNormal" style=3D""><a href=3D"https://www.facebook.com/gre=
enbaumlaw?fref=3Dts&amp;ref=3Dbr_tf"><span style=3D"font-size:11.0pt; font-=
family:&quot;Arial Narrow&quot;,sans-serif; color:#1F497D; text-decoration:=
none"><img border=3D"0" width=3D"16" height=3D"16" id=3D"x_Picture_x0020_4"=
 style=3D"width:.1666in; height:.1666in" data-outlook-trace=3D"F:1|T:1" src=
=3D"cid:[email protected]"></span></a><span style=3D"font-size=
:11.0pt; font-family:&quot;Arial Narrow&quot;,sans-serif; color:#1D5183"></=
span></p>
</td>
</tr>
</tbody>
</table>
<p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">&nbsp;</span></p>
<p class=3D"x_MsoNormal">&nbsp;</p>
</div>
<br>
<br>
<p style=3D"font-family:Verdana; font-size:10pt; color:#666666"><b>Disclaim=
er</b></p>
<p style=3D"font-family:Verdana; font-size:8pt; color:#666666">This e-mail =
(including any attachments) is intended only for the exclusive use of the i=
ndividual to whom it is addressed. The information contained hereinafter ma=
y be proprietary, confidential, privileged
 and exempt from disclosure under applicable law. If the reader of this e-m=
ail is not the intended recipient or agent responsible for delivering the m=
essage to the intended recipient, the reader is hereby put on notice that a=
ny use, dissemination, distribution
 or copying of this communication is strictly prohibited. If the reader has=
 received this communication in error, please immediately notify the sender=
 by telephone (732-549-5600) or e-mail and delete all copies of this e-mail=
 and any attachments. Thank you.</p>
</div>
</body>
</html>

--_000_BL3PR11MB5715BDCC40DDF0C0A48BF638DAF0ABL3PR11MB5715namp_--

--_007_BL3PR11MB5715BDCC40DDF0C0A48BF638DAF0ABL3PR11MB5715namp_
Content-Type: image/jpeg; name="image001.jpg"
Content-Description: image001.jpg
Content-Disposition: inline; filename="image001.jpg"; size=3448;
	creation-date="Thu, 23 Oct 2025 16:46:07 GMT";
	modification-date="Thu, 23 Oct 2025 17:30:43 GMT"
Content-ID: <[email protected]>
Content-Transfer-Encoding: base64

/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAoHBwkHBgoJCAkLCwoMDxkQDw4ODx4WFxIZJCAmJSMg
IyIoLTkwKCo2KyIjMkQyNjs9QEBAJjBGS0U+Sjk/QD3/2wBDAQsLCw8NDx0QEB09KSMpPT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT3/wAARCAA+ALwDASIA
AhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQA
AAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3
ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWm
p6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEA
AwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSEx
BhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElK
U1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3
uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD1TUNS
e1uIbW1t/tF3MCyoW2qqjqxNR2uqTjUUstQtVgllUtEySb0fHUdAQajTnxjIT/DYjH/fdPj1WOfV
YLe40+4hmbeYpJVXt1xg0AawIorlrW7v00a51W4u3fyPNEcOAFOGIBb1olvWsYbW5j1n7VKZEWaE
yKVbccHAHTGaAOpyPWjNc490L7UL1Z9WNklvJ5UcaSKpJwMsc9eTUMep3t5a6WsdyFkluXhllQAh
wueR9cUAdHeXH2W0mn27vKQvt9cCltZ/tNpDPt2+YgfHpkZrAu/tFnLf2Ul1LcQPYvMplwWQjIIz
6Goil7YeHrbUftspeNI2aDA8spwNuPp3oA6nI9aMisK/J+2SNeauLOEgeRHE4VunJbPXmq+l6pdX
TaPvm3CUzpIQOJNvANAHS5HrRkVzmrahdW8+rCGYqILRJIxj7rEnJpLtNRtZbDy9RkZ71/Ll3AFU
+XOVGOOlAHSZrLu9UuYtUFlaWQnfyvNJaUIAM4qPTzPa65cWMlzJcRCFZkaXllJJBGfSq93NcQ+L
c2tt9oc2YyvmBMDf15oAvWGqPc3k1pdWzW1xEofbvDBlPGQRWlXJvqFxFPqt/NGIL6GBI0tz8wVS
3Dbuhyf5VduorzSRaXH9oTz75kimSTG1g3GRxxg0Ab+RRmueTUblfD1wrSk30UzWoc9d5bCn8iDR
/aN0fDSfvf8ATjKLUuBzv3bScfQZoA6HNV7+6NnZTThd3lruxnGaxWuheaheRT6q1mlswijVZFUs
cAljnr1oS9kvvCd08siyyR74jIvR9rYz+VAHQqcgGnU1fuj6U6gAooooAxdQWay1qLUY4HnhaEwT
LEMuozkMB3FRLcPqXiCwnhtbqOGBJN7yxlB8wGOtb2BRigDnrfTbibwlc2RTy5pDLtV+OrEj86ak
zzJbQ2ukGG53KJWltwEjA+8c9/bFdHiq9/dpYWM1zICViQsQOpoAxVQadqF99q06S5SeXzoZI4RJ
nIGVPpyKVLe9kbR3ntljZJ3d0jUARqVOM4p8+o6vZ2Qv7iK0a3ADSQx7t6qfQ9CRmt1GDqGHIIyD
TAw9VtZ5tSuHjidkbTnjDAZBYngfWq0j3d5olvpTWNwlwyxxyMy/IoGMnd+HSumxVcNc/bmUpH9l
2Aqwb5i2eRj0pAYsQaw1e/eewmuJZpA0EqJuBXAG3P8ADiqtnb3llb6bczWkpNvNN5sUYyyhzwQO
4rZu9YSPRJdQtMSKhwN2QCd201pL6mmByt7Dd3zavMtnMizWqJCGHzPgnt2+lauoQSyXGkMkbERT
bnwPujYRzUmr67aaK9ut2ZM3DFU2Ju6DJJ9AB3rLuviB4ftEif7b5yS52mFS3Trn0pqLeyJckt2a
ccEg8TzT7G8o2qqH7Z3E4pBBL/wlLT+W3k/ZAu/tu3ZxUGh+LdM8QzyxafJKzxKGcOhXg1Le318u
rxWNiluS0JlLTFuxxjik01uNNPYp6tptzeX9+IUOJbJVRj90sr5xTrqefWFtLZLK5hKzJJM0qbVQ
KckZ7/hVq11K6XURY6lbxxySKXikhYlHA6jnoa1uopDOemsLj/hJgqxMbKSRbp37B1UjH4nBoSwu
B4lZDC32FZDdiTsXK7cfnzXQ1XvTcrasbJI3n42rIcA+tAGLsGnanfm6057mK4kEsUkcIk7AFT6c
ipZhcf8ACK3LXcMcMjKzeWigbFzwDjvitwcgZ6+1Udc40S7/ANymBeX7o+lOpq/dH0p1IAopM0tA
BRRRQAVBd20V5bS28wzHKpVhnsanqnqlrJe6bcQQyGKV0IRwcYPagDKW7vNARIdSH2mwBCJdKPmj
HYOP6il+ynUfEN/DLcTfZo44isaSFRkg85FNu31TU9NbT301opJVEckzSKYwO5Hc1esLKS21i8lK
/uXiiRGz12gg0wMOOCaXw7c6hLeXDXNuXEL+YRtCHAyOhzjnNaURa+1iSGWSQRyWMblUcrgk9Rjp
RFptyvhi8s2jAnlMu1d395iRz+NT2VlPFq/nyIBH9jSLOc/MDyKQGDFZpF4IuZo3k8x8qdzkgYk9
OlalzaHTL7TZ4Z52kmnEU2+QkSAg9ug5HaoV0+//AOEeudMa1w4YmOTeCsgL5+o49a1NUtZrmTTm
iXIhuVkfnouDQBzvxFuo9Nj02+kUyiOV4/J6CUMuGUntxmvNri2g07F9a28d9psxwhmzmM943wRh
vfv2r1nxlpt3q9lBa29hHeQsxMoaXy3Q4+Vlb1rkLHwbrOlSytaacZ45l2yQXVwnluP9oAc47V1U
ZqMTlqwbka/gX7BFrt7FYWK24NrFNv8ANZiQ3O0g9MV0sn/I4w/9eTf+hisfwloVzp2s3t5PYvbf
aIwDuuRL8wPQYHAA9a1r+O8h16K9trM3MYtzEQJApB3Z71hUactDemrRDVTjXtG/35f/AEGs6/8A
sa/bTc6lcS3ylihgZ8Q/3VwvA981pW9veXurRXt9ClulujLFCH3tlurE9OlU7a21Ky06506KyDu7
SFbgyDYwbJye+eaksfZ3c4vtKnmkYpe2uxhnjzANwOPU81Be3E8mn6teJLIq+ekUW1sYCkA4+pzV
q4027PhqzjgQfb7QI8ak/wAQ4Iz9M0650qYeFRYxKGnwpYZ6tuBbn86QEWtOiapD/aUk8enGLAeN
iqiTP8ZHI46dqmuIZIPC06SXIucIdkvXKZ4578d6mu3voL5iLY3dnJEF8tSuUbvnPUGqYspdP8I3
EMoCth2EYOQgLZCg+1MC/ckjWtNGSAUlyB34FKCf+EkYZOPsgOM/7dMv0uFv7G5gt2nWJXDBWAIy
Bjr9KjZ7xdTW8WwlZWt/LKB1yp3E+tIChfGwOp6mt7uMoVPKC7t33f4ce9b2nCYabbC4OZvKXfn1
xzUFjDMt/ezyxmNZvLKgnJ4XB/WtAdKAFooooAKSlooATFGBS0UAUdU1FdMtRKYpJmd1jSNMbnY9
AM1Uv/EMWnm3EttOTKgkcYAMS5Vcnn1YDir+oWEGpW3kXAYrkMCrFSpHQgjoarXGgWF0LYSxORbK
FX5zyvBw3qMgHn0oASTXII9WFgY5PNMix7scZZSw/QVBYeJ7XUdSmsYo5hNC8isGH9wgEj2OePoa
tvo9m+qDUWjY3C453HbkDAOOmcEjNMg0KwtdQa8ihIuGRkZ9x5DNuP60AU18VW76Jc6n9nmWKB9h
VioYnIHrx15B6VfTVI3ubOAowe7jaRcEEALjOT+IqFfDlgljc2gSQx3LBpCZCWJGMc9eMCp30mCW
e0mZpvNtARG/mHJBxkH1BwOtAFe216G41WWxWKVWj3gSEDa5TG4DvxuHWq1p4ttrzRrvUYrefy7Y
4ZOCT+Rx359Kvw6PZwX8t7HGwml3Zy5IGcbiB2JwM/So4tBsLe0mtYUeOOYKG2OQfl6EHsaALlld
C9sorhUKCVQwUkHH4jg1mReJYLmw1G5ggllFg7K6cAuBzuXnp1/KtKzsobGyS0tlKQxjaoz/AFqp
beHtOs4biK3g2JcR+VKAx+cc8n35PNAFy1ujc2Mdy0TRb037GIJA61QuPENvb+Hl1do5TCyhljAG
85OAK044kigWFBhFXaB7AYrPHh3Txp8VjJG8ttE/mLHK5YA84H0GelAEGpeKLPSxA0ySss8ayRso
6gkD9Acn2p95epqHhea6iVlSSMlQ3XGcZp8nh7Tp4LWKWAulrG0UW5j8qsNpH5Va/s63GmLYKpW3
WMRhQeijpzQBaUfKPpS4oHGBS0AJiloooA//2Q==

--_007_BL3PR11MB5715BDCC40DDF0C0A48BF638DAF0ABL3PR11MB5715namp_
Content-Type: image/png; name="image002.png"
Content-Description: image002.png
Content-Disposition: inline; filename="image002.png"; size=687;
	creation-date="Thu, 23 Oct 2025 16:46:07 GMT";
	modification-date="Thu, 23 Oct 2025 17:30:43 GMT"
Content-ID: <[email protected]>
Content-Transfer-Encoding: base64

iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAAlwSFlzAAAO
xAAADsQBlSsOGwAAABl0RVh0U29mdHdhcmUATWljcm9zb2Z0IE9mZmljZX/tNXEAAAIvSURBVDhP
jVPPS1RRGD3vvvue7zk/tEEtjcgakGxXtAtpGxIELaKFLQJXFbTvDwiKCGLatXXXJnAlRWQwTIsY
bZCUGYIRszIV7YczOvN+dO67k89poX7wPe733v3OPefc70ncfXsP0n6I0O9A4ONQYQhAJYIJCdN8
gsATBOAL41D9CANEabljkh262WCzFwI7XEuidzBZ7hvNOqSmzeZmgBMZB9fP9+L94h/kK5sEOpiR
YqCDJ4+c7saja1nkXlWR/7gCpJwDVcUAroXXPPXW0wKKpSXKSQDbNgVSR8D0mYKMXFPLbUUM4Ac4
mrSQTgqIzBGc683g8tkeTJc30OVIXMx2obj4Gy9Lq8RrgRGkTcKlbBq5G0O4/+ITfjYCPLgyiMqP
Pkh6cYr+bNR9bD33MFVaAzp1awzAwlPIjHCrjqanafq1bYw/nsbN0TMYHx3G1eE0ppQ/rdY2gFY/
Z8SAEGpQgMlCFe8+rOHCiK6Pp+gB/s1M2M5AeaTCtkyYnJOIgZq4gT44qU7Nbvehv+9hEEYm+3Tc
IYBNU9XaUkPFqZNGGNWm2T4bMQCdflPexJ1cHsXyCurdPbj9rIDZha9AOoHJuXWsVr7g89I6YKrr
JRABJQQ1qbm2Jea/1TA/qzaQW6OBuQW6raT3u5ip/sLMd9ZK/0BSi6FPErUar8RlzRc2Owf79aD4
3Kh0R/+Ip8WePBbXan/EYHl5Am5iDN6OdkU17F7HnvX/34TFQxrlv/pWz50W/4ytAAAAAElFTkSu
QmCC

--_007_BL3PR11MB5715BDCC40DDF0C0A48BF638DAF0ABL3PR11MB5715namp_
Content-Type: image/png; name="image003.png"
Content-Description: image003.png
Content-Disposition: inline; filename="image003.png"; size=670;
	creation-date="Thu, 23 Oct 2025 16:46:07 GMT";
	modification-date="Thu, 23 Oct 2025 17:30:43 GMT"
Content-ID: <[email protected]>
Content-Transfer-Encoding: base64

iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAAlwSFlzAAAO
xAAADsQBlSsOGwAAABl0RVh0U29mdHdhcmUATWljcm9zb2Z0IE9mZmljZX/tNXEAAAIeSURBVDhP
jVM9bxNBEH239+k7bEQwsaVIRiJCINr8ARoaSup01Ii/QEuDQEiIhopI/AEkitDRUIGQhQKhgAIn
WHICTvCd73y3y5szvjgxQpnCN56deftm5q1z9W16Vzn2feTaN0WO05ilFGDZMEZvOArWA0xyZYqC
Qes09TBaM09D1WrrDr3/FhtJ5Y9AC/78FToZwylp80QOciZOCB7Y00QpTOQyGPrT6pDsVYViIAxK
YwNo8J9LsG9jjYBZzMWN8zZuNhW+xAZbI2Ar1thPNdh7aRVAQoS1usKdjoun3yd4NSiw4lu4t+qW
X7Hurwy3uwlyy68KKwAB7E8MLgUWHl/xsNksEBO07R11/WZ3iM+DBO3WctnWMQaSNmbBkINY9hVu
tSrsajMfyEDVQjhMNtP6oxZcUthJDV4PMlyOgqpo5uynOd7tjVGL6rKPRQY2YzLx5z80Vr0E1y/4
8GaTYvqjbh/dGOicc6viYwwKUmp6wLWGjZQi8QSRJjc/+djHw08/sdRegW8rFKWQTrQgrArG3TTB
7kGOZ8MRvh6m2Nw5xPuDAkutNpr1CLkods6qSVE7yCiWl3vAi99jFFTZhJrwwrPoXDyD0PcXissW
lM1H8ZeSkG5ENdSjkMqj1glg8+HIudC25t6K4RoUz5xRkiAKOHUGys3wa9ETRuLrE5Rn7EvpU+tO
r9fbCML6usniarcLO/xHwHJd5Fm2/Qfh0dn7gsKPKAAAAABJRU5ErkJggg==

--_007_BL3PR11MB5715BDCC40DDF0C0A48BF638DAF0ABL3PR11MB5715namp_
Content-Type: image/png; name="image004.png"
Content-Description: image004.png
Content-Disposition: inline; filename="image004.png"; size=637;
	creation-date="Thu, 23 Oct 2025 16:46:07 GMT";
	modification-date="Thu, 23 Oct 2025 17:30:43 GMT"
Content-ID: <[email protected]>
Content-Transfer-Encoding: base64

iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAAlwSFlzAAAO
xAAADsQBlSsOGwAAABl0RVh0U29mdHdhcmUATWljcm9zb2Z0IE9mZmljZX/tNXEAAAH9SURBVDhP
jVM9axRRFD3z5s3szm7WbDaODMYQMUvAJlXAysRCUlilFEyVPyCipZ1IsNDCKmCbNo1RLEQ0pFMs
VCK6MRgwYvyI7IqZ3Z15H943WeKuMyReePC+7rnnnnsvn7p077Ji7JZWMqeVwv+YZVkALVvpRS6g
71hSMK2NMz1kmNaa/v99M2fQ0rY7y+k609n8b7ZiRLECY4CXd8BpQ677JmUEvkc7HbnVFqiODGJy
4hT6Ci4ePnuHjU8/kc/xHo69p85THEsUPRdX585ifCzAt50GVp7X0I5EwiRJoWMpAEY0f4dNBH4J
1eFBLD16ieu376PUfwT9pXJKoRSAyXtkqIyLF8ZR8BycCAYwMz2Bt5t11H+1wDkJ0mWZAKPDFcyc
P42cyzF5ZgyVch+uzD9AJCQcxz44hVLRxev327i58ATX5s5h9cU6btxdRiMEfN8/PAUT4Uc9xJva
dyqhwIfNr/i43UT15JDpnZ7oBi2VghGY24wE84guh0fV8I8OwHUdSCkPZ2B+JFWiJaVKOtA4qq7S
HSiiqbGp9U69ifmFx3i1tgEv5yRA3V243weMGVV7h8io39htYfnpF8RRG8cDEi9jHkzP8N0wRLHg
7Q1HBzYZHtoHxyqwbRtC0Mj9k4IRVAgF/nlrazHvFWe1jAkgi2T2gFuMkzai9gdWac3JOlDOjQAA
AABJRU5ErkJggg==

--_007_BL3PR11MB5715BDCC40DDF0C0A48BF638DAF0ABL3PR11MB5715namp_--

--===============9090814833651025624==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

--===============9090814833651025624==--