Re: Request for configuration assistance
"Al Lewis \(allewi\) via Snort-users" <[email protected]> Thu, 23 Oct 2025 20:48:37 +0000
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <BL3PR11MB5715B0E42F8EDE8250BCB822DAF0A@BL3PR11MB5715.namprd11.prod.outlook.com> |
--===============4949737472444652036== Content-Language: en-US Content-Type: multipart/related; boundary="_007_BL3PR11MB5715B0E42F8EDE8250BCB822DAF0ABL3PR11MB5715namp_"; type="multipart/alternative" --_007_BL3PR11MB5715B0E42F8EDE8250BCB822DAF0ABL3PR11MB5715namp_ Content-Type: multipart/alternative; boundary="_000_BL3PR11MB5715B0E42F8EDE8250BCB822DAF0ABL3PR11MB5715namp_" --_000_BL3PR11MB5715B0E42F8EDE8250BCB822DAF0ABL3PR11MB5715namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable If you are using debian, you should be able to setup a packet capture with = tcpdump and capture a single packet for traffic to that IP only. Albert Lewis Email: [email protected]<mailto:[email protected]> ________________________________ From: David Melczer <[email protected]> Sent: Thursday, October 23, 2025 2:42 PM To: Al Lewis (allewi) <[email protected]>; [email protected] <snor= [email protected]> Subject: RE: Request for configuration assistance I do know that Snort itself can do packet capture. Is there a way to speci= fy to only capture from a particular IP? Otherwise, the packet capture is = going to be enormous from an 80-person enterprise behind this IDS. Even wi= th just the IP, the packet capture will likely be large because the alerts = are triggering during a laptop Windows 11 imaging process=85 I could setup a wireshark system also if that would help. For now, I=92m taking the cheap way out though=85instead of turning on/off = the sensor during imaging (which was our previous strategy), I=92ve actuall= y commented out those 11 rules from my et_snort3.rules. At least I=92m not= flooding my IT team=92s emails but I do know it leaves a small blind spot= =85 -Dave David Z. Melczer | Director of Information Technology Greenbaum, Rowe, Smith & Davis LLP Delivery: 99 Wood Avenue South | Iselin, NJ | 08830 Mailing: P.O. Box 5600 | Woodbridge, NJ | 07095 T: 732.476.3284 | F: 732.476.3285 | vCard<http://www.greenbaumlaw.com/v= card-1999.vcf> [cid:[email protected]] greenbaumlaw.com<http://www.greenbaumlaw.com/> [cid:[email protected]]<https://www.linkedin.com/company/green= baum-rowe-smith-&-davis-llp?trk=3Dtop_nav_home> [cid:[email protected]]<https://twitter.com/greenbaumlaw> [cid:[email protected]]<https://www.facebook.com/greenbaumlaw?= fref=3Dts&ref=3Dbr_tf> From: Al Lewis (allewi) <[email protected]> Sent: Thursday, October 23, 2025 2:35 PM To: [email protected]; David Melczer <[email protected]>;= Al Lewis (allewi) <[email protected]> Subject: Re: Request for configuration assistance *** External Email Message *** The gid/sid should probably be removed as that doesnt match what you had li= sted below. Without a sample of the traffic it would be hard to replicate your exact is= sue. I will try it out and see if there is a problem. Albert Lewis Email: [email protected]<mailto:[email protected]> ________________________________ From: Snort-users <[email protected]<mailto:snort-users-b= [email protected]>> on behalf of Al Lewis (allewi) via Snort-users <sn= [email protected]<mailto:[email protected]>> Sent: Thursday, October 23, 2025 1:31 PM To: [email protected]<mailto:[email protected]> <snort-= [email protected]<mailto:[email protected]>>; David Melczer <= [email protected]<mailto:[email protected]>> Subject: Re: [Snort-users] Request for configuration assistance Do you have a sample of the traffic that is alerting (with the suppression = in place) that you can share? Albert Lewis Email: [email protected]<mailto:[email protected]> ________________________________ From: Snort-users <[email protected]<mailto:snort-users-b= [email protected]>> on behalf of David Melczer via Snort-users <snort-= [email protected]<mailto:[email protected]>> Sent: Thursday, October 23, 2025 12:46 PM To: [email protected]<mailto:[email protected]> <snort-= [email protected]<mailto:[email protected]>> Subject: [Snort-users] Request for configuration assistance Good day. We have a Snort3 sensor running 3.9.6.0<http://3.9.6.0> with the ETOPEN rul= eset. The sensor runs on Debian 13, if that is relevant. Every time we go= to image one of our laptops, we get several hundred ET alerts despite the = fact that I have what I believe is the proper suppression rules set in SNOR= T.LUA (the IP address of the machine generating these alerts is 172.19.8.25= ). Here is what I believe to be a relevant clip: -------------------------------------------------------------------------- -- 6. configure filters --------------------------------------------------------------------------- include 'et_thresholds.lua' -- below are examples of filters -- each table is a list of records suppress =3D { -- don't want to any of see these { track =3D 'by_src', ip =3D '172.19.8.25' }, { track =3D 'by_dst', ip =3D '172.19.8.25' }, =85 } I=92ve tried different syntax that I=92ve seen online, including: { gid =3D 0, sid =3D 0, track =3D 'by_src', ip =3D '172.19.8.25' }, { gid =3D 0, sid =3D 0, track =3D 'by_dst', ip =3D '172.19.8.25' }, It would appear though that nothing I do suppresses error messages from thi= s IP=85 Does anyone have any idea how I might be able to accomplish this? Thank you very much in advance for any assistance you can provide. -Dave David Z. Melczer | Director of Information Technology Greenbaum, Rowe, Smith & Davis LLP Delivery: 99 Wood Avenue South | Iselin, NJ | 08830 Mailing: P.O. Box 5600 | Woodbridge, NJ | 07095 T: 732.476.3284 | F: 732.476.3285 | vCard<http://www.greenbaumlaw.com/v= card-1999.vcf> [cid:[email protected]] greenbaumlaw.com<http://www.greenbaumlaw.com/> [cid:[email protected]]<https://www.linkedin.com/company/green= baum-rowe-smith-&-davis-llp?trk=3Dtop_nav_home> [cid:[email protected]]<https://twitter.com/greenbaumlaw> [cid:[email protected]]<https://www.facebook.com/greenbaumlaw?= fref=3Dts&ref=3Dbr_tf> Disclaimer This e-mail (including any attachments) is intended only for the exclusive = use of the individual to whom it is addressed. The information contained he= reinafter may be proprietary, confidential, privileged and exempt from disc= losure under applicable law. If the reader of this e-mail is not the intend= ed recipient or agent responsible for delivering the message to the intende= d recipient, the reader is hereby put on notice that any use, dissemination= , distribution or copying of this communication is strictly prohibited. If = the reader has received this communication in error, please immediately not= ify the sender by telephone (732-549-5600) or e-mail and delete all copies = of this e-mail and any attachments. Thank you. Disclaimer This e-mail (including any attachments) is intended only for the exclusive = use of the individual to whom it is addressed. The information contained he= reinafter may be proprietary, confidential, privileged and exempt from disc= losure under applicable law. If the reader of this e-mail is not the intend= ed recipient or agent responsible for delivering the message to the intende= d recipient, the reader is hereby put on notice that any use, dissemination= , distribution or copying of this communication is strictly prohibited. If = the reader has received this communication in error, please immediately not= ify the sender by telephone (732-549-5600) or e-mail and delete all copies = of this e-mail and any attachments. Thank you. --_000_BL3PR11MB5715B0E42F8EDE8250BCB822DAF0ABL3PR11MB5715namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1= 252"> <style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo= ttom:0;} </style> </head> <body dir=3D"ltr"> <div style=3D"font-family: "Courier New", monospace; font-size: 1= 2pt; color: rgb(0, 0, 0);" class=3D"elementToProof"> If you are using debian, you should be able to setup a packet capture with = tcpdump and capture a single packet for traffic to that IP <b><i>only</i></b>.</div> <div class=3D"elementToProof" id=3D"Signature"> <div style=3D"font-family: "Courier New", monospace; font-size: 1= 2pt; color: rgb(0, 0, 0);" class=3D"elementToProof"> <br> </div> <p style=3D"line-height: normal; margin: 0px; font-family: Courier; font-si= ze: 16px; color: rgb(30, 73, 125);" class=3D"elementToProof"> <b>Albert Lewis</b></p> <p style=3D"line-height: normal; margin: 0px; font-family: Courier; font-si= ze: 15px; color: rgb(127, 127, 127);" class=3D"elementToProof"> <span style=3D"font-size: 16px; color: rgb(153, 153, 153);">Email: </span><= span style=3D"font-size: 16px; color: rgb(128, 27, 128);"><u><a style=3D"co= lor: rgb(128, 27, 128); margin-top: 0px; margin-bottom: 0px;" href=3D"mailt= o:[email protected]">[email protected]</a></u></span><span style=3D"font-size= : 16px; color: rgb(79, 129, 189);"> </span></p> </div> <div id=3D"appendonsend"></div> <hr style=3D"display:inline-block;width:98%" tabindex=3D"-1"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st= yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> David Melczer <dme= [email protected]><br> <b>Sent:</b> Thursday, October 23, 2025 2:42 PM<br> <b>To:</b> Al Lewis (allewi) <[email protected]>; [email protected]= ort.org <[email protected]><br> <b>Subject:</b> RE: Request for configuration assistance</font> <div> </div> </div> <style> <!-- @font-face {font-family:Courier} @font-face {font-family:"Cambria Math"} @font-face {font-family:Calibri} @font-face {font-family:Verdana} @font-face {font-family:Aptos} @font-face {font-family:"Arial Narrow"} @font-face {font-family:"Univers LT Std 57 Cn"} p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal {margin:0in; font-size:12.0pt; font-family:"Aptos",sans-serif} a:link, span.x_MsoHyperlink {color:blue; text-decoration:underline} p.x_elementtoproof, li.x_elementtoproof, div.x_elementtoproof {margin:0in; font-size:12.0pt; font-family:"Aptos",sans-serif} p.x_xxmsonormal, li.x_xxmsonormal, div.x_xxmsonormal {margin:0in; font-size:12.0pt; font-family:"Aptos",sans-serif} span.x_EmailStyle24 {font-family:"Aptos",sans-serif; color:windowtext} .x_MsoChpDefault {font-size:10.0pt} @page WordSection1 {margin:1.0in 1.0in 1.0in 1.0in} div.x_WordSection1 {} --> </style><style type=3D"text/css"> <!-- .x_style1 {font-family:"Times New Roman"} --> </style> <div lang=3D"EN-US" link=3D"blue" vlink=3D"purple" style=3D"word-wrap:break= -word"> <div class=3D"x_WordSection1"> <p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">I do know that Sn= ort itself can do packet capture. Is there a way to specify to only c= apture from a particular IP? Otherwise, the packet capture is going t= o be enormous from an 80-person enterprise behind this IDS. Even with just the IP, the packet capture will likely be l= arge because the alerts are triggering during a laptop Windows 11 imaging p= rocess=85</span></p> <p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt"> </span></p> <p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">I could setup a w= ireshark system also if that would help.</span></p> <p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt"> </span></p> <p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">For now, I=92m ta= king the cheap way out though=85instead of turning on/off the sensor during= imaging (which was our previous strategy), I=92ve actually commented out t= hose 11 rules from my et_snort3.rules. At least I=92m not flooding my IT team=92s emails but I do know it leaves a s= mall blind spot=85</span></p> <p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt"> </span></p> <p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt">-Dave</span></p> <p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt"> </span></p> <div> <p class=3D"x_MsoNormal"><b><span style=3D"font-size:11.0pt; font-family:&q= uot;Arial Narrow",sans-serif; color:#1D5183">David Z. Melczer </span></b><span style=3D"font-size:11.0pt; font-family:"Univers LT St= d 57 Cn"; color:#538135">|</span><span style=3D"font-size:11.0pt; font= -family:"Arial Narrow",sans-serif; color:#1F497D"> </span><span style=3D"font-size:9.0pt; font-family:"Arial Narrow"= ,sans-serif; color:#1F497D">Director of Information Technology</span><i><sp= an style=3D"font-size:11.0pt; font-family:"Arial Narrow",sans-ser= if; color:#1F497D"></span></i></p> <p class=3D"x_MsoNormal" style=3D"line-height:11.5pt"><b><span style=3D"fon= t-size:3.0pt; font-family:"Arial Narrow",sans-serif; color:#1F497= D"> </span></b></p> <p class=3D"x_MsoNormal" style=3D"line-height:11.5pt"><b><span style=3D"fon= t-size:10.0pt; font-family:"Arial Narrow",sans-serif; color:#1F49= 7D">Greenbaum, Rowe, Smith & Davis LLP</span></b></p> <p class=3D"x_MsoNormal" style=3D"line-height:11.5pt"><span style=3D"font-s= ize:10.0pt; font-family:"Arial Narrow",sans-serif; color:#1F497D"= >Delivery: 99 Wood Avenue South </span><span style=3D"font-size:10.0pt; font-family:"Univers LT Std 57= Cn"; color:#538135">|</span><span style=3D"font-size:10.0pt; font-fam= ily:"Arial Narrow",sans-serif; color:#1F497D"> Iselin, NJ </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#538135">|</span><span style=3D"font-size:10.0pt; font-= family:"Arial Narrow",sans-serif; color:#1F497D"> 08830</span></p= > <p class=3D"x_MsoNormal" style=3D"line-height:11.5pt"><span style=3D"font-s= ize:10.0pt; font-family:"Arial Narrow",sans-serif; color:#1F497D"= >Mailing: P.O. Box 5600 </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#538135">|</span><span style=3D"font-size:10.0pt; font-= family:"Arial Narrow",sans-serif; color:#1F497D"> Woodbridge, NJ </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#538135">|</span><span style=3D"font-size:10.0pt; font-= family:"Arial Narrow",sans-serif; color:#1F497D"> 07095</span></p= > <p class=3D"x_MsoNormal" style=3D"line-height:11.5pt"><span style=3D"font-s= ize:10.0pt; font-family:"Arial Narrow",sans-serif; color:#1F497D"= >T:</span><span style=3D"font-size:11.0pt; color:#1F497D"> </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#1F497D">732.476.3284</span><span style=3D"font-size:11= .0pt; color:#1F497D"> </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#1F497D"> </span><span style=3D"font-size:10.0pt; = font-family:"Arial Narrow",sans-serif; color:#538135">| </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#1F497D"> F:</span><span style=3D"font-size:11.0pt= ; color:#1F497D"> </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#1F497D">732.476.3285 </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#538135">| </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#1D5183"> </span><span style=3D"font-size:11.0pt; = color:#1F497D"><a href=3D"http://www.greenbaumlaw.com/vcard-1999.vcf"><span= style=3D"font-size:10.0pt; font-family:"Arial Narrow",sans-serif= ; color:#1D5183">vCard</span></a></span><span style=3D"font-size:10.0pt; fo= nt-family:"Arial Narrow",sans-serif; color:#1F497D"></span></p> <p class=3D"x_MsoNormal" style=3D"line-height:10.0pt"><span style=3D"font-s= ize:4.0pt; font-family:"Arial Narrow",sans-serif; color:#1D5183">= </span></p> <p class=3D"x_MsoNormal" style=3D""><span style=3D"font-size:9.0pt; font-fa= mily:"Arial Narrow",sans-serif; color:#1F497D"><img border=3D"0" = width=3D"188" height=3D"62" id=3D"x_Picture_x0020_1" style=3D"width:1.9583i= n; height:.6458in" data-outlook-trace=3D"F:1|T:1" src=3D"cid:image001.jpg@0= 1DC442B.3F1E11D0"></span></p> <table class=3D"x_MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpaddin= g=3D"0" style=3D"margin-left:.7pt; border-collapse:collapse"> <tbody> <tr style=3D"height:.2in"> <td width=3D"144" style=3D"width:1.5in; padding:0in .7pt 0in .7pt; height:.= 2in"> <p class=3D"x_MsoNormal" style=3D""><span style=3D"font-size:11.0pt; color:= #1F497D"><a href=3D"http://www.greenbaumlaw.com/"><span style=3D"font-size:= 12.0pt; font-family:"Arial Narrow",sans-serif; color:#ED7D31">gre= enbaumlaw.com</span></a></span><u><span style=3D"font-family:"Arial Na= rrow",sans-serif; color:#538135"> </span></u><span style=3D"font-family:"Arial Narrow",sans-serif; = color:#538135"></span></p> </td> <td width=3D"18" style=3D"width:13.5pt; padding:0in .7pt 0in .7pt; height:.= 2in"> <p class=3D"x_MsoNormal" style=3D""><a href=3D"https://www.linkedin.com/com= pany/greenbaum-rowe-smith-&-davis-llp?trk=3Dtop_nav_home"><span style= =3D"font-size:11.0pt; font-family:"Arial Narrow",sans-serif; colo= r:#1F497D; text-decoration:none"><img border=3D"0" width=3D"16" height=3D"1= 6" id=3D"x_Picture_x0020_2" style=3D"width:.1666in; height:.1666in" data-ou= tlook-trace=3D"F:1|T:1" src=3D"cid:[email protected]"></span><= /a><span style=3D"font-size:11.0pt; font-family:"Arial Narrow",sa= ns-serif; color:#1D5183"></span></p> </td> <td width=3D"18" style=3D"width:13.5pt; padding:0in .7pt 0in .7pt; height:.= 2in"> <p class=3D"x_MsoNormal" style=3D""><a href=3D"https://twitter.com/greenbau= mlaw"><span style=3D"font-size:11.0pt; font-family:"Arial Narrow"= ,sans-serif; color:#1F497D; text-decoration:none"><img border=3D"0" width= =3D"16" height=3D"16" id=3D"x_Picture_x0020_1774721132" style=3D"width:.166= 6in; height:.1666in" data-outlook-trace=3D"F:1|T:1" src=3D"cid:image003.png= @01DC442B.3F1E11D0"></span></a><span style=3D"font-size:11.0pt; font-family= :"Arial Narrow",sans-serif; color:#1D5183"></span></p> </td> <td width=3D"18" style=3D"width:13.5pt; padding:0in .7pt 0in .7pt; height:.= 2in"> <p class=3D"x_MsoNormal" style=3D""><a href=3D"https://www.facebook.com/gre= enbaumlaw?fref=3Dts&ref=3Dbr_tf"><span style=3D"font-size:11.0pt; font-= family:"Arial Narrow",sans-serif; color:#1F497D; text-decoration:= none"><img border=3D"0" width=3D"16" height=3D"16" id=3D"x_Picture_x0020_48= 2798400" style=3D"width:.1666in; height:.1666in" data-outlook-trace=3D"F:1|= T:1" src=3D"cid:[email protected]"></span></a><span style=3D"f= ont-size:11.0pt; font-family:"Arial Narrow",sans-serif; color:#1D= 5183"></span></p> </td> </tr> </tbody> </table> <p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt"> </span></p> </div> <p class=3D"x_MsoNormal"><span style=3D"font-size:11.0pt"> </span></p> <div> <div style=3D"border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0i= n 0in 0in"> <p class=3D"x_MsoNormal"><b><span style=3D"font-size:11.0pt; font-family:&q= uot;Calibri",sans-serif">From:</span></b><span style=3D"font-size:11.0= pt; font-family:"Calibri",sans-serif"> Al Lewis (allewi) <alle= [email protected]> <br> <b>Sent:</b> Thursday, October 23, 2025 2:35 PM<br> <b>To:</b> [email protected]; David Melczer <dmelczer@greenbau= mlaw.com>; Al Lewis (allewi) <[email protected]><br> <b>Subject:</b> Re: Request for configuration assistance</span></p> </div> </div> <p class=3D"x_MsoNormal"> </p> <p class=3D"x_MsoNormal" style=3D"margin-bottom:12.0pt"><b><span style=3D"f= ont-size:13.5pt; font-family:"Verdana",sans-serif; color:#666666;= background:yellow">*** External Email Message ***</span></b> </p> <div> <p class=3D"x_MsoNormal"><span style=3D"font-family:"Courier New"= ; color:black">The gid/sid should probably be removed as that doesnt match = what you had listed below.</span></p> </div> <div> <p class=3D"x_MsoNormal"><span style=3D"font-family:"Courier New"= ; color:black"> </span></p> </div> <div> <p class=3D"x_MsoNormal"><span style=3D"font-family:"Courier New"= ; color:black">Without a sample of the traffic it would be hard to replicat= e your exact issue. I will try it out and see if there is a problem.</span>= </p> </div> <div> <p class=3D"x_MsoNormal"><span style=3D"font-family:"Courier New"= ; color:black"> </span></p> </div> <div> <p class=3D"x_MsoNormal"><span style=3D"font-family:"Courier New"= ; color:black"> </span></p> </div> <div id=3D"x_Signature"> <div> <p class=3D"x_MsoNormal"><span style=3D"font-family:"Courier New"= ; color:black"> </span></p> </div> <p class=3D"x_elementtoproof"><b><span style=3D"font-family:Courier; color:= #1E497D">Albert Lewis</span></b><span style=3D"font-family:Courier; color:#= 1E497D"></span></p> <p class=3D"x_elementtoproof"><span style=3D"font-family:Courier; color:#99= 9999">Email: </span><u><span style=3D"font-family:Courier; color:#801B80"><a href=3D"mai= lto:[email protected]"><span style=3D"color:#801B80">[email protected]</span>= </a></span></u><span style=3D"font-family:Courier; color:#4F81BD"> </s= pan><span style=3D"font-size:11.5pt; font-family:Courier; color:#7F7F7F"></= span></p> </div> <div class=3D"x_MsoNormal" align=3D"center" style=3D"text-align:center"> <hr size=3D"2" width=3D"98%" align=3D"center"> </div> <div id=3D"x_divRplyFwdMsg"> <p class=3D"x_MsoNormal"><b><span style=3D"font-size:11.0pt; font-family:&q= uot;Calibri",sans-serif; color:black">From:</span></b><span style=3D"f= ont-size:11.0pt; font-family:"Calibri",sans-serif; color:black"> = Snort-users <<a href=3D"mailto:[email protected]">snor= [email protected]</a>> on behalf of Al Lewis (allewi) via Snort-users <<a href=3D"mailto:snort= [email protected]">[email protected]</a>><br> <b>Sent:</b> Thursday, October 23, 2025 1:31 PM<br> <b>To:</b> <a href=3D"mailto:[email protected]">snort-users@lists= .snort.org</a> <<a href=3D"mailto:[email protected]">snort-use= [email protected]</a>>; David Melczer <<a href=3D"mailto:dmelczer@gr= eenbaumlaw.com">[email protected]</a>><br> <b>Subject:</b> Re: [Snort-users] Request for configuration assistance</spa= n> </p> <div> <p class=3D"x_MsoNormal"> </p> </div> </div> <div> <div> <p class=3D"x_MsoNormal"><span style=3D"font-family:"Courier New"= ; color:black">Do you have a sample of the traffic that is alerting (with t= he suppression in place) that you can share?</span></p> </div> <div id=3D"x_x_Signature"> <div> <p class=3D"x_MsoNormal"><span style=3D"font-family:"Courier New"= ; color:black"> </span></p> </div> <p><b><span style=3D"font-family:Courier; color:#1E497D">Albert Lewis</span= ></b><span style=3D"font-family:Courier; color:#1E497D"></span></p> <p><span style=3D"font-family:Courier; color:#999999">Email: </span><u><spa= n style=3D"font-family:Courier; color:#801B80"><a href=3D"mailto:allewi@cis= co.com"><span style=3D"color:#801B80">[email protected]</span></a></span></u= ><span style=3D"font-family:Courier; color:#4F81BD"> </span><span styl= e=3D"font-size:11.5pt; font-family:Courier; color:#7F7F7F"></span></p> </div> <div class=3D"x_MsoNormal" align=3D"center" style=3D"text-align:center"> <hr size=3D"2" width=3D"98%" align=3D"center"> </div> <div id=3D"x_x_divRplyFwdMsg"> <p class=3D"x_MsoNormal"><b><span style=3D"font-size:11.0pt; font-family:&q= uot;Calibri",sans-serif; color:black">From:</span></b><span style=3D"f= ont-size:11.0pt; font-family:"Calibri",sans-serif; color:black"> = Snort-users <<a href=3D"mailto:[email protected]">snor= [email protected]</a>> on behalf of David Melczer via Snort-users <<a href=3D"mailto:snort-use= [email protected]">[email protected]</a>><br> <b>Sent:</b> Thursday, October 23, 2025 12:46 PM<br> <b>To:</b> <a href=3D"mailto:[email protected]">snort-users@lists= .snort.org</a> <<a href=3D"mailto:[email protected]">snort-use= [email protected]</a>><br> <b>Subject:</b> [Snort-users] Request for configuration assistance</span> <= /p> <div> <p class=3D"x_MsoNormal"> </p> </div> </div> <div> <div> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt">Good day.</span= ></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt"> </span></= p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt">We have a Snort= 3 sensor running <a href=3D"http://3.9.6.0">3.9.6.0</a> with the ETOPEN ruleset. The s= ensor runs on Debian 13, if that is relevant. Every time we go to ima= ge one of our laptops, we get several hundred ET alerts despite the fact th= at I have what I believe is the proper suppression rules set in SNORT.LUA (the IP address of the machine generating these ale= rts is 172.19.8.25). Here is what I believe to be a relevant clip:</s= pan></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt"> </span></= p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New"">-----------------------------------------------------= ---------------------</span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New"">-- 6. configure filters</span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New"">-----------------------------------------------------= ----------------------</span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New""> </span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New"">include 'et_thresholds.lua'</span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New""> </span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New"">-- below are examples of filters</span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New"">-- each table is a list of records</span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New""> </span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New"">suppress =3D</span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New"">{</span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New""> -- don't want to any of see these<= /span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New""> <span style=3D"color:black; background:yellow">{ track =3D 'by_src', ip =3D= '172.19.8.25' },</span></span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New"; color:black; background:yellow"> { = track =3D 'by_dst', ip =3D '172.19.8.25' },</span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New"">=85</span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New"">}</span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt"> </span></= p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt">I=92ve tried di= fferent syntax that I=92ve seen online, including:</span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt"> </span></= p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New""> <span style=3D"color:black; background:yellow">{ gid =3D 0, sid =3D 0, trac= k =3D 'by_src', ip =3D '172.19.8.25' },</span></span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; font-family:&qu= ot;Courier New"; color:black; background:yellow"> { = gid =3D 0, sid =3D 0, track =3D 'by_dst', ip =3D '172.19.8.25' },</span></p= > <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt"> </span></= p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt">It would appear= though that nothing I do suppresses error messages from this IP=85</span><= /p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt"> </span></= p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt">Does anyone hav= e any idea how I might be able to accomplish this?</span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt"> </span></= p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt">Thank you very = much in advance for any assistance you can provide.</span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt"> </span></= p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt">-Dave</span></p= > <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt"> </span></= p> <p class=3D"x_xxmsonormal"><b><span style=3D"font-size:11.0pt; font-family:= "Arial Narrow",sans-serif; color:#1D5183">David Z. Melczer </span></b><span style=3D"font-size:11.0pt; font-family:"Univers LT St= d 57 Cn"; color:#538135">|</span><span style=3D"font-size:11.0pt; font= -family:"Arial Narrow",sans-serif; color:#1F497D"> </span><span style=3D"font-size:9.0pt; font-family:"Arial Narrow"= ,sans-serif; color:#1F497D">Director of Information Technology</span></p> <p class=3D"x_xxmsonormal" style=3D"line-height:11.5pt"><b><span style=3D"f= ont-size:3.0pt; font-family:"Arial Narrow",sans-serif; color:#1F4= 97D"> </span></b></p> <p class=3D"x_xxmsonormal" style=3D"line-height:11.5pt"><b><span style=3D"f= ont-size:10.0pt; font-family:"Arial Narrow",sans-serif; color:#1F= 497D">Greenbaum, Rowe, Smith & Davis LLP</span></b></p> <p class=3D"x_xxmsonormal" style=3D"line-height:11.5pt"><span style=3D"font= -size:10.0pt; font-family:"Arial Narrow",sans-serif; color:#1F497= D">Delivery: 99 Wood Avenue South </span><span style=3D"font-size:10.0pt; font-family:"Univers LT Std 57= Cn"; color:#538135">|</span><span style=3D"font-size:10.0pt; font-fam= ily:"Arial Narrow",sans-serif; color:#1F497D"> Iselin, NJ </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#538135">|</span><span style=3D"font-size:10.0pt; font-= family:"Arial Narrow",sans-serif; color:#1F497D"> 08830</span></p= > <p class=3D"x_xxmsonormal" style=3D"line-height:11.5pt"><span style=3D"font= -size:10.0pt; font-family:"Arial Narrow",sans-serif; color:#1F497= D">Mailing: P.O. Box 5600 </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#538135">|</span><span style=3D"font-size:10.0pt; font-= family:"Arial Narrow",sans-serif; color:#1F497D"> Woodbridge, NJ </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#538135">|</span><span style=3D"font-size:10.0pt; font-= family:"Arial Narrow",sans-serif; color:#1F497D"> 07095</span></p= > <p class=3D"x_xxmsonormal" style=3D"line-height:11.5pt"><span style=3D"font= -size:10.0pt; font-family:"Arial Narrow",sans-serif; color:#1F497= D">T:</span><span style=3D"font-size:11.0pt; color:#1F497D"> </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#1F497D">732.476.3284</span><span style=3D"font-size:11= .0pt; color:#1F497D"> </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#1F497D"> </span><span style=3D"font-size:10.0pt; = font-family:"Arial Narrow",sans-serif; color:#538135">| </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#1F497D"> F:</span><span style=3D"font-size:11.0pt= ; color:#1F497D"> </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#1F497D">732.476.3285 </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#538135">| </span><span style=3D"font-size:10.0pt; font-family:"Arial Narrow"= ;,sans-serif; color:#1D5183"> </span><span style=3D"font-size:11.0pt; = color:#1F497D"><a href=3D"http://www.greenbaumlaw.com/vcard-1999.vcf"><span= style=3D"font-size:10.0pt; font-family:"Arial Narrow",sans-serif= ; color:#1D5183">vCard</span></a></span></p> <p class=3D"x_xxmsonormal" style=3D"line-height:10.0pt"><span style=3D"font= -size:4.0pt; font-family:"Arial Narrow",sans-serif; color:#1D5183= "> </span></p> <p class=3D"x_xxmsonormal"><span style=3D"font-size:9.0pt; font-family:&quo= t;Arial Narrow",sans-serif; color:#1F497D"><img border=3D"0" width=3D"= 188" height=3D"62" id=3D"x_x_x_Picture_x0020_1" style=3D"width:1.9583in; he= ight:.6458in" data-outlook-trace=3D"F:1|T:1" src=3D"cid:image001.jpg@01DC44= 2B.3F1E11D0"></span></p> <table class=3D"x_MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpaddin= g=3D"0" style=3D"margin-left:.7pt; border-collapse:collapse"> <tbody> <tr style=3D"height:.2in"> <td width=3D"144" style=3D"width:1.5in; padding:0in .7pt 0in .7pt; height:.= 2in"> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt; color:#1F497D">= <a href=3D"http://www.greenbaumlaw.com/"><span style=3D"font-size:12.0pt; f= ont-family:"Arial Narrow",sans-serif; color:#ED7D31">greenbaumlaw= .com</span></a></span><u><span style=3D"font-family:"Arial Narrow"= ;,sans-serif; color:#538135"> </span></u></p> </td> <td width=3D"18" style=3D"width:13.5pt; padding:0in .7pt 0in .7pt; height:.= 2in"> <p class=3D"x_xxmsonormal"><a href=3D"https://www.linkedin.com/company/gree= nbaum-rowe-smith-&-davis-llp?trk=3Dtop_nav_home"><span style=3D"font-si= ze:11.0pt; font-family:"Arial Narrow",sans-serif; color:#1F497D; = text-decoration:none"><img border=3D"0" width=3D"16" height=3D"16" id=3D"x_= x_x_Picture_x0020_2" style=3D"width:.1666in; height:.1666in" data-outlook-t= race=3D"F:1|T:1" src=3D"cid:[email protected]"></span></a></p> </td> <td width=3D"18" style=3D"width:13.5pt; padding:0in .7pt 0in .7pt; height:.= 2in"> <p class=3D"x_xxmsonormal"><a href=3D"https://twitter.com/greenbaumlaw"><sp= an style=3D"font-size:11.0pt; font-family:"Arial Narrow",sans-ser= if; color:#1F497D; text-decoration:none"><img border=3D"0" width=3D"16" hei= ght=3D"16" id=3D"x_x_x_Picture_x0020_3" style=3D"width:.1666in; height:.166= 6in" data-outlook-trace=3D"F:1|T:1" src=3D"cid:[email protected]= D0"></span></a></p> </td> <td width=3D"18" style=3D"width:13.5pt; padding:0in .7pt 0in .7pt; height:.= 2in"> <p class=3D"x_xxmsonormal"><a href=3D"https://www.facebook.com/greenbaumlaw= ?fref=3Dts&ref=3Dbr_tf"><span style=3D"font-size:11.0pt; font-family:&q= uot;Arial Narrow",sans-serif; color:#1F497D; text-decoration:none"><im= g border=3D"0" width=3D"16" height=3D"16" id=3D"x_x_x_Picture_x0020_4" styl= e=3D"width:.1666in; height:.1666in" data-outlook-trace=3D"F:1|T:1" src=3D"c= id:[email protected]"></span></a></p> </td> </tr> </tbody> </table> <p class=3D"x_xxmsonormal"><span style=3D"font-size:11.0pt"> </span></= p> <p class=3D"x_xxmsonormal"> </p> </div> <p class=3D"x_MsoNormal" style=3D"margin-bottom:12.0pt"> </p> <p><b><span style=3D"font-size:10.0pt; font-family:"Verdana",sans= -serif; color:#666666">Disclaimer</span></b><span style=3D"font-size:10.0pt= ; font-family:"Verdana",sans-serif; color:#666666"></span></p> <p><span style=3D"font-size:8.0pt; font-family:"Verdana",sans-ser= if; color:#666666">This e-mail (including any attachments) is intended only= for the exclusive use of the individual to whom it is addressed. The infor= mation contained hereinafter may be proprietary, confidential, privileged and exempt from disclosure under applicable law. = If the reader of this e-mail is not the intended recipient or agent respons= ible for delivering the message to the intended recipient, the reader is he= reby put on notice that any use, dissemination, distribution or copying of this communication is strictly p= rohibited. If the reader has received this communication in error, please i= mmediately notify the sender by telephone (732-549-5600) or e-mail and dele= te all copies of this e-mail and any attachments. Thank you.</span></p> </div> </div> </div> <br> <br> <p style=3D"font-family:Verdana; font-size:10pt; color:#666666"><b>Disclaim= er</b></p> <p style=3D"font-family:Verdana; font-size:8pt; color:#666666">This e-mail = (including any attachments) is intended only for the exclusive use of the i= ndividual to whom it is addressed. The information contained hereinafter ma= y be proprietary, confidential, privileged and exempt from disclosure under applicable law. If the reader of this e-m= ail is not the intended recipient or agent responsible for delivering the m= essage to the intended recipient, the reader is hereby put on notice that a= ny use, dissemination, distribution or copying of this communication is strictly prohibited. If the reader has= received this communication in error, please immediately notify the sender= by telephone (732-549-5600) or e-mail and delete all copies of this e-mail= and any attachments. Thank you.</p> </div> </body> </html> --_000_BL3PR11MB5715B0E42F8EDE8250BCB822DAF0ABL3PR11MB5715namp_-- --_007_BL3PR11MB5715B0E42F8EDE8250BCB822DAF0ABL3PR11MB5715namp_ Content-Type: image/jpeg; name="image001.jpg" Content-Description: image001.jpg Content-Disposition: inline; filename="image001.jpg"; size=3448; creation-date="Thu, 23 Oct 2025 18:42:33 GMT"; modification-date="Thu, 23 Oct 2025 20:45:42 GMT" Content-ID: <[email protected]> Content-Transfer-Encoding: base64 /9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAoHBwkHBgoJCAkLCwoMDxkQDw4ODx4WFxIZJCAmJSMg IyIoLTkwKCo2KyIjMkQyNjs9QEBAJjBGS0U+Sjk/QD3/2wBDAQsLCw8NDx0QEB09KSMpPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT3/wAARCAA+ALwDASIA AhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQA AAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3 ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWm p6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEA AwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSEx BhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElK U1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3 uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD1TUNS e1uIbW1t/tF3MCyoW2qqjqxNR2uqTjUUstQtVgllUtEySb0fHUdAQajTnxjIT/DYjH/fdPj1WOfV YLe40+4hmbeYpJVXt1xg0AawIorlrW7v00a51W4u3fyPNEcOAFOGIBb1olvWsYbW5j1n7VKZEWaE yKVbccHAHTGaAOpyPWjNc490L7UL1Z9WNklvJ5UcaSKpJwMsc9eTUMep3t5a6WsdyFkluXhllQAh wueR9cUAdHeXH2W0mn27vKQvt9cCltZ/tNpDPt2+YgfHpkZrAu/tFnLf2Ul1LcQPYvMplwWQjIIz 6Goil7YeHrbUftspeNI2aDA8spwNuPp3oA6nI9aMisK/J+2SNeauLOEgeRHE4VunJbPXmq+l6pdX TaPvm3CUzpIQOJNvANAHS5HrRkVzmrahdW8+rCGYqILRJIxj7rEnJpLtNRtZbDy9RkZ71/Ll3AFU +XOVGOOlAHSZrLu9UuYtUFlaWQnfyvNJaUIAM4qPTzPa65cWMlzJcRCFZkaXllJJBGfSq93NcQ+L c2tt9oc2YyvmBMDf15oAvWGqPc3k1pdWzW1xEofbvDBlPGQRWlXJvqFxFPqt/NGIL6GBI0tz8wVS 3Dbuhyf5VduorzSRaXH9oTz75kimSTG1g3GRxxg0Ab+RRmueTUblfD1wrSk30UzWoc9d5bCn8iDR /aN0fDSfvf8ATjKLUuBzv3bScfQZoA6HNV7+6NnZTThd3lruxnGaxWuheaheRT6q1mlswijVZFUs cAljnr1oS9kvvCd08siyyR74jIvR9rYz+VAHQqcgGnU1fuj6U6gAooooAxdQWay1qLUY4HnhaEwT LEMuozkMB3FRLcPqXiCwnhtbqOGBJN7yxlB8wGOtb2BRigDnrfTbibwlc2RTy5pDLtV+OrEj86ak zzJbQ2ukGG53KJWltwEjA+8c9/bFdHiq9/dpYWM1zICViQsQOpoAxVQadqF99q06S5SeXzoZI4RJ nIGVPpyKVLe9kbR3ntljZJ3d0jUARqVOM4p8+o6vZ2Qv7iK0a3ADSQx7t6qfQ9CRmt1GDqGHIIyD TAw9VtZ5tSuHjidkbTnjDAZBYngfWq0j3d5olvpTWNwlwyxxyMy/IoGMnd+HSumxVcNc/bmUpH9l 2Aqwb5i2eRj0pAYsQaw1e/eewmuJZpA0EqJuBXAG3P8ADiqtnb3llb6bczWkpNvNN5sUYyyhzwQO 4rZu9YSPRJdQtMSKhwN2QCd201pL6mmByt7Dd3zavMtnMizWqJCGHzPgnt2+lauoQSyXGkMkbERT bnwPujYRzUmr67aaK9ut2ZM3DFU2Ju6DJJ9AB3rLuviB4ftEif7b5yS52mFS3Trn0pqLeyJckt2a ccEg8TzT7G8o2qqH7Z3E4pBBL/wlLT+W3k/ZAu/tu3ZxUGh+LdM8QzyxafJKzxKGcOhXg1Le318u rxWNiluS0JlLTFuxxjik01uNNPYp6tptzeX9+IUOJbJVRj90sr5xTrqefWFtLZLK5hKzJJM0qbVQ KckZ7/hVq11K6XURY6lbxxySKXikhYlHA6jnoa1uopDOemsLj/hJgqxMbKSRbp37B1UjH4nBoSwu B4lZDC32FZDdiTsXK7cfnzXQ1XvTcrasbJI3n42rIcA+tAGLsGnanfm6057mK4kEsUkcIk7AFT6c ipZhcf8ACK3LXcMcMjKzeWigbFzwDjvitwcgZ6+1Udc40S7/ANymBeX7o+lOpq/dH0p1IAopM0tA BRRRQAVBd20V5bS28wzHKpVhnsanqnqlrJe6bcQQyGKV0IRwcYPagDKW7vNARIdSH2mwBCJdKPmj HYOP6il+ynUfEN/DLcTfZo44isaSFRkg85FNu31TU9NbT301opJVEckzSKYwO5Hc1esLKS21i8lK /uXiiRGz12gg0wMOOCaXw7c6hLeXDXNuXEL+YRtCHAyOhzjnNaURa+1iSGWSQRyWMblUcrgk9Rjp RFptyvhi8s2jAnlMu1d395iRz+NT2VlPFq/nyIBH9jSLOc/MDyKQGDFZpF4IuZo3k8x8qdzkgYk9 OlalzaHTL7TZ4Z52kmnEU2+QkSAg9ug5HaoV0+//AOEeudMa1w4YmOTeCsgL5+o49a1NUtZrmTTm iXIhuVkfnouDQBzvxFuo9Nj02+kUyiOV4/J6CUMuGUntxmvNri2g07F9a28d9psxwhmzmM943wRh vfv2r1nxlpt3q9lBa29hHeQsxMoaXy3Q4+Vlb1rkLHwbrOlSytaacZ45l2yQXVwnluP9oAc47V1U ZqMTlqwbka/gX7BFrt7FYWK24NrFNv8ANZiQ3O0g9MV0sn/I4w/9eTf+hisfwloVzp2s3t5PYvbf aIwDuuRL8wPQYHAA9a1r+O8h16K9trM3MYtzEQJApB3Z71hUactDemrRDVTjXtG/35f/AEGs6/8A sa/bTc6lcS3ylihgZ8Q/3VwvA981pW9veXurRXt9ClulujLFCH3tlurE9OlU7a21Ky06506KyDu7 SFbgyDYwbJye+eaksfZ3c4vtKnmkYpe2uxhnjzANwOPU81Be3E8mn6teJLIq+ekUW1sYCkA4+pzV q4027PhqzjgQfb7QI8ak/wAQ4Iz9M0650qYeFRYxKGnwpYZ6tuBbn86QEWtOiapD/aUk8enGLAeN iqiTP8ZHI46dqmuIZIPC06SXIucIdkvXKZ4578d6mu3voL5iLY3dnJEF8tSuUbvnPUGqYspdP8I3 EMoCth2EYOQgLZCg+1MC/ckjWtNGSAUlyB34FKCf+EkYZOPsgOM/7dMv0uFv7G5gt2nWJXDBWAIy Bjr9KjZ7xdTW8WwlZWt/LKB1yp3E+tIChfGwOp6mt7uMoVPKC7t33f4ce9b2nCYabbC4OZvKXfn1 xzUFjDMt/ezyxmNZvLKgnJ4XB/WtAdKAFooooAKSlooATFGBS0UAUdU1FdMtRKYpJmd1jSNMbnY9 AM1Uv/EMWnm3EttOTKgkcYAMS5Vcnn1YDir+oWEGpW3kXAYrkMCrFSpHQgjoarXGgWF0LYSxORbK FX5zyvBw3qMgHn0oASTXII9WFgY5PNMix7scZZSw/QVBYeJ7XUdSmsYo5hNC8isGH9wgEj2OePoa tvo9m+qDUWjY3C453HbkDAOOmcEjNMg0KwtdQa8ihIuGRkZ9x5DNuP60AU18VW76Jc6n9nmWKB9h VioYnIHrx15B6VfTVI3ubOAowe7jaRcEEALjOT+IqFfDlgljc2gSQx3LBpCZCWJGMc9eMCp30mCW e0mZpvNtARG/mHJBxkH1BwOtAFe216G41WWxWKVWj3gSEDa5TG4DvxuHWq1p4ttrzRrvUYrefy7Y 4ZOCT+Rx359Kvw6PZwX8t7HGwml3Zy5IGcbiB2JwM/So4tBsLe0mtYUeOOYKG2OQfl6EHsaALlld C9sorhUKCVQwUkHH4jg1mReJYLmw1G5ggllFg7K6cAuBzuXnp1/KtKzsobGyS0tlKQxjaoz/AFqp beHtOs4biK3g2JcR+VKAx+cc8n35PNAFy1ujc2Mdy0TRb037GIJA61QuPENvb+Hl1do5TCyhljAG 85OAK044kigWFBhFXaB7AYrPHh3Txp8VjJG8ttE/mLHK5YA84H0GelAEGpeKLPSxA0ySss8ayRso 6gkD9Acn2p95epqHhea6iVlSSMlQ3XGcZp8nh7Tp4LWKWAulrG0UW5j8qsNpH5Va/s63GmLYKpW3 WMRhQeijpzQBaUfKPpS4oHGBS0AJiloooA//2Q== --_007_BL3PR11MB5715B0E42F8EDE8250BCB822DAF0ABL3PR11MB5715namp_ Content-Type: image/png; name="image002.png" Content-Description: image002.png Content-Disposition: inline; filename="image002.png"; size=687; creation-date="Thu, 23 Oct 2025 18:42:33 GMT"; modification-date="Thu, 23 Oct 2025 20:45:42 GMT" Content-ID: <[email protected]> Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAAlwSFlzAAAO xAAADsQBlSsOGwAAABl0RVh0U29mdHdhcmUATWljcm9zb2Z0IE9mZmljZX/tNXEAAAIvSURBVDhP jVPPS1RRGD3vvvue7zk/tEEtjcgakGxXtAtpGxIELaKFLQJXFbTvDwiKCGLatXXXJnAlRWQwTIsY bZCUGYIRszIV7YczOvN+dO67k89poX7wPe733v3OPefc70ncfXsP0n6I0O9A4ONQYQhAJYIJCdN8 gsATBOAL41D9CANEabljkh262WCzFwI7XEuidzBZ7hvNOqSmzeZmgBMZB9fP9+L94h/kK5sEOpiR YqCDJ4+c7saja1nkXlWR/7gCpJwDVcUAroXXPPXW0wKKpSXKSQDbNgVSR8D0mYKMXFPLbUUM4Ac4 mrSQTgqIzBGc683g8tkeTJc30OVIXMx2obj4Gy9Lq8RrgRGkTcKlbBq5G0O4/+ITfjYCPLgyiMqP Pkh6cYr+bNR9bD33MFVaAzp1awzAwlPIjHCrjqanafq1bYw/nsbN0TMYHx3G1eE0ppQ/rdY2gFY/ Z8SAEGpQgMlCFe8+rOHCiK6Pp+gB/s1M2M5AeaTCtkyYnJOIgZq4gT44qU7Nbvehv+9hEEYm+3Tc IYBNU9XaUkPFqZNGGNWm2T4bMQCdflPexJ1cHsXyCurdPbj9rIDZha9AOoHJuXWsVr7g89I6YKrr JRABJQQ1qbm2Jea/1TA/qzaQW6OBuQW6raT3u5ip/sLMd9ZK/0BSi6FPErUar8RlzRc2Owf79aD4 3Kh0R/+Ip8WePBbXan/EYHl5Am5iDN6OdkU17F7HnvX/34TFQxrlv/pWz50W/4ytAAAAAElFTkSu QmCC --_007_BL3PR11MB5715B0E42F8EDE8250BCB822DAF0ABL3PR11MB5715namp_ Content-Type: image/png; name="image003.png" Content-Description: image003.png Content-Disposition: inline; filename="image003.png"; size=670; creation-date="Thu, 23 Oct 2025 18:42:33 GMT"; modification-date="Thu, 23 Oct 2025 20:45:42 GMT" Content-ID: <[email protected]> Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAAlwSFlzAAAO xAAADsQBlSsOGwAAABl0RVh0U29mdHdhcmUATWljcm9zb2Z0IE9mZmljZX/tNXEAAAIeSURBVDhP jVM9bxNBEH239+k7bEQwsaVIRiJCINr8ARoaSup01Ii/QEuDQEiIhopI/AEkitDRUIGQhQKhgAIn WHICTvCd73y3y5szvjgxQpnCN56deftm5q1z9W16Vzn2feTaN0WO05ilFGDZMEZvOArWA0xyZYqC Qes09TBaM09D1WrrDr3/FhtJ5Y9AC/78FToZwylp80QOciZOCB7Y00QpTOQyGPrT6pDsVYViIAxK YwNo8J9LsG9jjYBZzMWN8zZuNhW+xAZbI2Ar1thPNdh7aRVAQoS1usKdjoun3yd4NSiw4lu4t+qW X7Hurwy3uwlyy68KKwAB7E8MLgUWHl/xsNksEBO07R11/WZ3iM+DBO3WctnWMQaSNmbBkINY9hVu tSrsajMfyEDVQjhMNtP6oxZcUthJDV4PMlyOgqpo5uynOd7tjVGL6rKPRQY2YzLx5z80Vr0E1y/4 8GaTYvqjbh/dGOicc6viYwwKUmp6wLWGjZQi8QSRJjc/+djHw08/sdRegW8rFKWQTrQgrArG3TTB 7kGOZ8MRvh6m2Nw5xPuDAkutNpr1CLkods6qSVE7yCiWl3vAi99jFFTZhJrwwrPoXDyD0PcXissW lM1H8ZeSkG5ENdSjkMqj1glg8+HIudC25t6K4RoUz5xRkiAKOHUGys3wa9ETRuLrE5Rn7EvpU+tO r9fbCML6usniarcLO/xHwHJd5Fm2/Qfh0dn7gsKPKAAAAABJRU5ErkJggg== --_007_BL3PR11MB5715B0E42F8EDE8250BCB822DAF0ABL3PR11MB5715namp_ Content-Type: image/png; name="image004.png" Content-Description: image004.png Content-Disposition: inline; filename="image004.png"; size=637; creation-date="Thu, 23 Oct 2025 18:42:33 GMT"; modification-date="Thu, 23 Oct 2025 20:45:42 GMT" Content-ID: <[email protected]> Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAAlwSFlzAAAO xAAADsQBlSsOGwAAABl0RVh0U29mdHdhcmUATWljcm9zb2Z0IE9mZmljZX/tNXEAAAH9SURBVDhP jVM9axRRFD3z5s3szm7WbDaODMYQMUvAJlXAysRCUlilFEyVPyCipZ1IsNDCKmCbNo1RLEQ0pFMs VCK6MRgwYvyI7IqZ3Z15H943WeKuMyReePC+7rnnnnsvn7p077Ji7JZWMqeVwv+YZVkALVvpRS6g 71hSMK2NMz1kmNaa/v99M2fQ0rY7y+k609n8b7ZiRLECY4CXd8BpQ677JmUEvkc7HbnVFqiODGJy 4hT6Ci4ePnuHjU8/kc/xHo69p85THEsUPRdX585ifCzAt50GVp7X0I5EwiRJoWMpAEY0f4dNBH4J 1eFBLD16ieu376PUfwT9pXJKoRSAyXtkqIyLF8ZR8BycCAYwMz2Bt5t11H+1wDkJ0mWZAKPDFcyc P42cyzF5ZgyVch+uzD9AJCQcxz44hVLRxev327i58ATX5s5h9cU6btxdRiMEfN8/PAUT4Uc9xJva dyqhwIfNr/i43UT15JDpnZ7oBi2VghGY24wE84guh0fV8I8OwHUdSCkPZ2B+JFWiJaVKOtA4qq7S HSiiqbGp9U69ifmFx3i1tgEv5yRA3V243weMGVV7h8io39htYfnpF8RRG8cDEi9jHkzP8N0wRLHg 7Q1HBzYZHtoHxyqwbRtC0Mj9k4IRVAgF/nlrazHvFWe1jAkgi2T2gFuMkzai9gdWac3JOlDOjQAA AABJRU5ErkJggg== --_007_BL3PR11MB5715B0E42F8EDE8250BCB822DAF0ABL3PR11MB5715namp_-- --===============4949737472444652036== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --===============4949737472444652036==--