Re: Request for configuration assistance
Nick Godwod via Snort-users <[email protected]> Fri, 24 Oct 2025 22:07:20 -0500
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
--===============0674376039563337691== Content-Type: multipart/alternative; boundary="Apple-Mail=_AAAB8FE0-5CFA-4355-94BE-DE28DC7C96F9" --Apple-Mail=_AAAB8FE0-5CFA-4355-94BE-DE28DC7C96F9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 You can do PCAP flows with Snort/Suricata, but its really just easier to = setup a tcpdump dump to listen for specific traffic during a timeframe = than mess with the Snort engine only. > On Oct 23, 2025, at 13:42, David Melczer via Snort-users = <[email protected]> wrote: >=20 > I do know that Snort itself can do packet capture. Is there a way to = specify to only capture from a particular IP? Otherwise, the packet = capture is going to be enormous from an 80-person enterprise behind this = IDS. Even with just the IP, the packet capture will likely be large = because the alerts are triggering during a laptop Windows 11 imaging = process=E2=80=A6 > =20 > I could setup a wireshark system also if that would help. > =20 > For now, I=E2=80=99m taking the cheap way out though=E2=80=A6instead = of turning on/off the sensor during imaging (which was our previous = strategy), I=E2=80=99ve actually commented out those 11 rules from my = et_snort3.rules. At least I=E2=80=99m not flooding my IT team=E2=80=99s = emails but I do know it leaves a small blind spot=E2=80=A6 > =20 > -Dave > =20 > David Z. Melczer | Director of Information Technology > =20 > Greenbaum, Rowe, Smith & Davis LLP > Delivery: 99 Wood Avenue South | Iselin, NJ | 08830 > Mailing: P.O. Box 5600 | Woodbridge, NJ | 07095 > T: 732.476.3284 | F: 732.476.3285 | vCard = <http://www.greenbaumlaw.com/vcard-1999.vcf> > =20 > <image001.jpg> > greenbaumlaw.com <http://www.greenbaumlaw.com/>=09 > <image002.png> = <https://www.linkedin.com/company/greenbaum-rowe-smith-&-davis-llp?trk=3Dt= op_nav_home>=09 > <image003.png> <https://twitter.com/greenbaumlaw>=09 > <image004.png> = <https://www.facebook.com/greenbaumlaw?fref=3Dts&ref=3Dbr_tf> > =20 > =20 > From: Al Lewis (allewi) <[email protected] <mailto:[email protected]>> > Sent: Thursday, October 23, 2025 2:35 PM > To: [email protected] <mailto:[email protected]>; = David Melczer <[email protected] = <mailto:[email protected]>>; Al Lewis (allewi) <[email protected] = <mailto:[email protected]>> > Subject: Re: Request for configuration assistance > =20 > *** External Email Message *** >=20 > The gid/sid should probably be removed as that doesnt match what you = had listed below. > =20 > Without a sample of the traffic it would be hard to replicate your = exact issue. I will try it out and see if there is a problem. > =20 > =20 > =20 > Albert Lewis > Email: [email protected] <mailto:[email protected]>=20 > From: Snort-users <[email protected] = <mailto:[email protected]>> on behalf of Al Lewis = (allewi) via Snort-users <[email protected] = <mailto:[email protected]>> > Sent: Thursday, October 23, 2025 1:31 PM > To: [email protected] <mailto:[email protected]> = <[email protected] <mailto:[email protected]>>; = David Melczer <[email protected] = <mailto:[email protected]>> > Subject: Re: [Snort-users] Request for configuration assistance > =20 > Do you have a sample of the traffic that is alerting (with the = suppression in place) that you can share? > =20 > Albert Lewis >=20 > Email: [email protected] <mailto:[email protected]>=20 >=20 > From: Snort-users <[email protected] = <mailto:[email protected]>> on behalf of David Melczer = via Snort-users <[email protected] = <mailto:[email protected]>> > Sent: Thursday, October 23, 2025 12:46 PM > To: [email protected] <mailto:[email protected]> = <[email protected] <mailto:[email protected]>> > Subject: [Snort-users] Request for configuration assistance > =20 > Good day. > =20 > We have a Snort3 sensor running 3.9.6.0 <http://3.9.6.0/> with the = ETOPEN ruleset. The sensor runs on Debian 13, if that is relevant. = Every time we go to image one of our laptops, we get several hundred ET = alerts despite the fact that I have what I believe is the proper = suppression rules set in SNORT.LUA (the IP address of the machine = generating these alerts is 172.19.8.25). Here is what I believe to be a = relevant clip: > =20 > = --------------------------------------------------------------------------= > -- 6. configure filters > = --------------------------------------------------------------------------= - > =20 > include 'et_thresholds.lua' > =20 > -- below are examples of filters > -- each table is a list of records > =20 > suppress =3D > { > -- don't want to any of see these > { track =3D 'by_src', ip =3D '172.19.8.25' }, > { track =3D 'by_dst', ip =3D '172.19.8.25' }, > =E2=80=A6 > } > =20 > I=E2=80=99ve tried different syntax that I=E2=80=99ve seen online, = including: > =20 > { gid =3D 0, sid =3D 0, track =3D 'by_src', ip =3D '172.19.8.25' = }, > { gid =3D 0, sid =3D 0, track =3D 'by_dst', ip =3D '172.19.8.25' = }, > =20 > It would appear though that nothing I do suppresses error messages = from this IP=E2=80=A6 > =20 > Does anyone have any idea how I might be able to accomplish this? > =20 > Thank you very much in advance for any assistance you can provide. > =20 > -Dave > =20 > David Z. Melczer | Director of Information Technology > =20 > Greenbaum, Rowe, Smith & Davis LLP > Delivery: 99 Wood Avenue South | Iselin, NJ | 08830 > Mailing: P.O. Box 5600 | Woodbridge, NJ | 07095 > T: 732.476.3284 | F: 732.476.3285 | vCard = <http://www.greenbaumlaw.com/vcard-1999.vcf> > =20 > <image001.jpg> > greenbaumlaw.com <http://www.greenbaumlaw.com/>=09 > <image002.png> = <https://www.linkedin.com/company/greenbaum-rowe-smith-&-davis-llp?trk=3Dt= op_nav_home>=09 > <image003.png> <https://twitter.com/greenbaumlaw>=09 > <image004.png> = <https://www.facebook.com/greenbaumlaw?fref=3Dts&ref=3Dbr_tf> > =20 > =20 > =20 >=20 > Disclaimer >=20 > This e-mail (including any attachments) is intended only for the = exclusive use of the individual to whom it is addressed. The information = contained hereinafter may be proprietary, confidential, privileged and = exempt from disclosure under applicable law. If the reader of this = e-mail is not the intended recipient or agent responsible for delivering = the message to the intended recipient, the reader is hereby put on = notice that any use, dissemination, distribution or copying of this = communication is strictly prohibited. If the reader has received this = communication in error, please immediately notify the sender by = telephone (732-549-5600) or e-mail and delete all copies of this e-mail = and any attachments. Thank you. >=20 >=20 >=20 > Disclaimer >=20 > This e-mail (including any attachments) is intended only for the = exclusive use of the individual to whom it is addressed. The information = contained hereinafter may be proprietary, confidential, privileged and = exempt from disclosure under applicable law. If the reader of this = e-mail is not the intended recipient or agent responsible for delivering = the message to the intended recipient, the reader is hereby put on = notice that any use, dissemination, distribution or copying of this = communication is strictly prohibited. If the reader has received this = communication in error, please immediately notify the sender by = telephone (732-549-5600) or e-mail and delete all copies of this e-mail = and any attachments. Thank you. >=20 > _______________________________________________ > Snort-users mailing list > [email protected] > Go to this URL to change user options or unsubscribe: > https://lists.snort.org/mailman/listinfo/snort-users >=20 > To unsubscribe, send an email to: > [email protected] >=20 > Please visit http://blog.snort.org to stay current on all the latest = Snort news! >=20 > Please follow these rules: = https://snort.org/faq/what-is-the-mailing-list-etiquette --Apple-Mail=_AAAB8FE0-5CFA-4355-94BE-DE28DC7C96F9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"content-type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"overflow-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;">You can do = PCAP flows with Snort/Suricata, but its really just easier to setup a = tcpdump dump to listen for specific traffic during a timeframe than mess = with the Snort engine only.<br = id=3D"lineBreakAtBeginningOfMessage"><div><br><blockquote = type=3D"cite"><div>On Oct 23, 2025, at 13:42, David Melczer via = Snort-users <[email protected]> wrote:</div><br = class=3D"Apple-interchange-newline"><div><meta charset=3D"UTF-8"><div = class=3D"WordSection1" style=3D"page: WordSection1; caret-color: rgb(0, = 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><div style=3D"margin: 0in; font-size: 12pt; = font-family: Aptos, sans-serif;"><span style=3D"font-size: 11pt;">I do = know that Snort itself can do packet capture. Is there a way to = specify to only capture from a particular IP? Otherwise, the = packet capture is going to be enormous from an 80-person enterprise = behind this IDS. Even with just the IP, the packet capture will = likely be large because the alerts are triggering during a laptop = Windows 11 imaging process=E2=80=A6<o:p></o:p></span></div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-size: = 11pt;"><o:p> </o:p></span></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt;">I could setup a wireshark system also if that = would help.<o:p></o:p></span></div><div style=3D"margin: 0in; font-size: = 12pt; font-family: Aptos, sans-serif;"><span style=3D"font-size: = 11pt;"><o:p> </o:p></span></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt;">For now, I=E2=80=99m taking the cheap way out = though=E2=80=A6instead of turning on/off the sensor during imaging = (which was our previous strategy), I=E2=80=99ve actually commented out = those 11 rules from my et_snort3.rules. At least I=E2=80=99m not = flooding my IT team=E2=80=99s emails but I do know it leaves a small = blind spot=E2=80=A6<o:p></o:p></span></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt;"><o:p> </o:p></span></div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-size: = 11pt;">-Dave<o:p></o:p></span></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt;"><o:p> </o:p></span></div><div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><b><span style=3D"font-size: 11pt; font-family: "Arial = Narrow", sans-serif; color: rgb(29, 81, 131);">David Z. = Melczer <span = class=3D"Apple-converted-space"> </span></span></b><span = style=3D"font-size: 11pt; font-family: "Univers LT Std 57 Cn"; = color: rgb(83, 129, 53);">|</span><span style=3D"font-size: 11pt; = font-family: "Arial Narrow", sans-serif; color: rgb(31, 73, = 125);"><span class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 9pt; font-family: "Arial Narrow", = sans-serif; color: rgb(31, 73, 125);">Director of Information = Technology</span><i><span style=3D"font-size: 11pt; font-family: = "Arial Narrow", sans-serif; color: rgb(31, 73, = 125);"><o:p></o:p></span></i></div><div style=3D"margin: 0in; font-size: = 12pt; font-family: Aptos, sans-serif; line-height: 11.5pt;"><b><span = style=3D"font-size: 3pt; font-family: "Arial Narrow", = sans-serif; color: rgb(31, 73, = 125);"><o:p> </o:p></span></b></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif; line-height: = 11.5pt;"><b><span style=3D"font-size: 10pt; font-family: "Arial = Narrow", sans-serif; color: rgb(31, 73, 125);">Greenbaum, Rowe, = Smith & Davis LLP<o:p></o:p></span></b></div><div style=3D"margin: = 0in; font-size: 12pt; font-family: Aptos, sans-serif; line-height: = 11.5pt;"><span style=3D"font-size: 10pt; font-family: "Arial = Narrow", sans-serif; color: rgb(31, 73, 125);">Delivery: 99 Wood = Avenue South<span = class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Univers LT Std 57 Cn"; = color: rgb(83, 129, 53);">|</span><span style=3D"font-size: 10pt; = font-family: "Arial Narrow", sans-serif; color: rgb(31, 73, = 125);"><span class=3D"Apple-converted-space"> </span>Iselin, = NJ<span class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(83, 129, 53);">|</span><span style=3D"font-size: = 10pt; font-family: "Arial Narrow", sans-serif; color: rgb(31, = 73, 125);"><span = class=3D"Apple-converted-space"> </span>08830<o:p></o:p></span></div>= <div style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif; line-height: 11.5pt;"><span style=3D"font-size: 10pt; = font-family: "Arial Narrow", sans-serif; color: rgb(31, 73, = 125);">Mailing: P.O. Box 5600<span = class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(83, 129, 53);">|</span><span style=3D"font-size: = 10pt; font-family: "Arial Narrow", sans-serif; color: rgb(31, = 73, 125);"><span class=3D"Apple-converted-space"> </span>Woodbridge, = NJ<span class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(83, 129, 53);">|</span><span style=3D"font-size: = 10pt; font-family: "Arial Narrow", sans-serif; color: rgb(31, = 73, 125);"><span = class=3D"Apple-converted-space"> </span>07095<o:p></o:p></span></div>= <div style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif; line-height: 11.5pt;"><span style=3D"font-size: 10pt; = font-family: "Arial Narrow", sans-serif; color: rgb(31, 73, = 125);">T:</span><span style=3D"font-size: 11pt; color: rgb(31, 73, = 125);"><span class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(31, 73, 125);">732.476.3284</span><span = style=3D"font-size: 11pt; color: rgb(31, 73, 125);"><span = class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(31, 73, 125);"> </span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(83, 129, 53);">|<span = class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(31, 73, 125);"> F:</span><span = style=3D"font-size: 11pt; color: rgb(31, 73, 125);"><span = class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(31, 73, 125);">732.476.3285 <span = class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(83, 129, 53);">|<span = class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(29, 81, 131);"> </span><span = style=3D"font-size: 11pt; color: rgb(31, 73, 125);"><a = href=3D"http://www.greenbaumlaw.com/vcard-1999.vcf" style=3D"color: = blue; text-decoration: underline;"><span style=3D"font-size: 10pt; = font-family: "Arial Narrow", sans-serif; color: rgb(29, 81, = 131);">vCard</span></a></span><span style=3D"font-size: 10pt; = font-family: "Arial Narrow", sans-serif; color: rgb(31, 73, = 125);"><o:p></o:p></span></div><div style=3D"margin: 0in; font-size: = 12pt; font-family: Aptos, sans-serif; line-height: 10pt;"><span = style=3D"font-size: 4pt; font-family: "Arial Narrow", = sans-serif; color: rgb(29, 81, 131);"><o:p> </o:p></span></div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-size: 9pt; font-family: "Arial = Narrow", sans-serif; color: rgb(31, 73, 125);"><span = id=3D"cid:[email protected]"><image001.jpg></span><o:p>= </o:p></span></div><table class=3D"MsoNormalTable" border=3D"0" = cellspacing=3D"0" cellpadding=3D"0" style=3D"margin-left: 0.7pt; = border-collapse: collapse;"><tbody><tr style=3D"height: 0.2in;"><td = width=3D"144" style=3D"width: 1.5in; padding: 0in 0.7pt; height: = 0.2in;"><div style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-size: 11pt; color: rgb(31, 73, = 125);"><a href=3D"http://www.greenbaumlaw.com/" style=3D"color: blue; = text-decoration: underline;"><span style=3D"font-size: 12pt; = font-family: "Arial Narrow", sans-serif; color: rgb(237, 125, = 49);">greenbaumlaw.com</span></a></span><u><span style=3D"font-family: = "Arial Narrow", sans-serif; color: rgb(83, 129, = 53);"></span></u><span style=3D"font-family: "Arial Narrow", = sans-serif; color: rgb(83, 129, 53);"><o:p></o:p></span></div></td><td = width=3D"18" style=3D"width: 13.5pt; padding: 0in 0.7pt; height: = 0.2in;"><div style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><a = href=3D"https://www.linkedin.com/company/greenbaum-rowe-smith-&-davis-= llp?trk=3Dtop_nav_home" style=3D"color: blue; text-decoration: = underline;"><span style=3D"font-size: 11pt; font-family: "Arial = Narrow", sans-serif; color: rgb(31, 73, 125); text-decoration: = none;"><span = id=3D"cid:[email protected]"><image002.png></span></spa= n></a><span style=3D"font-size: 11pt; font-family: "Arial = Narrow", sans-serif; color: rgb(29, 81, = 131);"><o:p></o:p></span></div></td><td width=3D"18" style=3D"width: = 13.5pt; padding: 0in 0.7pt; height: 0.2in;"><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><a = href=3D"https://twitter.com/greenbaumlaw" style=3D"color: blue; = text-decoration: underline;"><span style=3D"font-size: 11pt; = font-family: "Arial Narrow", sans-serif; color: rgb(31, 73, = 125); text-decoration: none;"><span = id=3D"cid:[email protected]"><image003.png></span></spa= n></a><span style=3D"font-size: 11pt; font-family: "Arial = Narrow", sans-serif; color: rgb(29, 81, = 131);"><o:p></o:p></span></div></td><td width=3D"18" style=3D"width: = 13.5pt; padding: 0in 0.7pt; height: 0.2in;"><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><a = href=3D"https://www.facebook.com/greenbaumlaw?fref=3Dts&ref=3Dbr_tf" = style=3D"color: blue; text-decoration: underline;"><span = style=3D"font-size: 11pt; font-family: "Arial Narrow", = sans-serif; color: rgb(31, 73, 125); text-decoration: none;"><span = id=3D"cid:[email protected]"><image004.png></span></spa= n></a><span style=3D"font-size: 11pt; font-family: "Arial = Narrow", sans-serif; color: rgb(29, 81, = 131);"><o:p></o:p></span></div></td></tr></tbody></table><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-size: = 11pt;"><o:p> </o:p></span></div></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt;"><o:p> </o:p></span></div><div><div = style=3D"border-width: 1pt medium medium; border-style: solid none none; = border-color: rgb(225, 225, 225) currentcolor currentcolor; = border-image: none; padding: 3pt 0in 0in;"><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><b><span = style=3D"font-size: 11pt; font-family: Calibri, = sans-serif;">From:</span></b><span style=3D"font-size: 11pt; = font-family: Calibri, sans-serif;"><span = class=3D"Apple-converted-space"> </span>Al Lewis (allewi) <<a = href=3D"mailto:[email protected]" style=3D"color: blue; text-decoration: = underline;">[email protected]</a>><br><b>Sent:</b><span = class=3D"Apple-converted-space"> </span>Thursday, October 23, 2025 = 2:35 PM<br><b>To:</b><span class=3D"Apple-converted-space"> </span><a= href=3D"mailto:[email protected]" style=3D"color: blue; = text-decoration: underline;">[email protected]</a>; David = Melczer <<a href=3D"mailto:[email protected]" style=3D"color: = blue; text-decoration: underline;">[email protected]</a>>; Al = Lewis (allewi) <<a href=3D"mailto:[email protected]" style=3D"color: = blue; text-decoration: = underline;">[email protected]</a>><br><b>Subject:</b><span = class=3D"Apple-converted-space"> </span>Re: Request for = configuration assistance<o:p></o:p></span></div></div></div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><o:p> </o:p></div><p class=3D"MsoNormal" = style=3D"margin: 0in 0in 12pt; font-size: 12pt; font-family: Aptos, = sans-serif;"><b><span style=3D"font-size: 13.5pt; font-family: Verdana, = sans-serif; color: rgb(102, 102, 102); background: yellow;">*** External = Email Message ***</span></b><o:p></o:p></p><div><div style=3D"margin: = 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-family: "Courier New";">The gid/sid should = probably be removed as that doesnt match what you had listed = below.<o:p></o:p></span></div></div><div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-family: "Courier = New";"><o:p> </o:p></span></div></div><div><div style=3D"margin:= 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-family: "Courier New";">Without a sample of the = traffic it would be hard to replicate your exact issue. I will try it = out and see if there is a = problem.<o:p></o:p></span></div></div><div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-family: "Courier = New";"><o:p> </o:p></span></div></div><div><div style=3D"margin:= 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-family: "Courier = New";"><o:p> </o:p></span></div></div><div = id=3D"Signature"><div><div style=3D"margin: 0in; font-size: 12pt; = font-family: Aptos, sans-serif;"><span style=3D"font-family: = "Courier New";"><o:p> </o:p></span></div></div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><b><span style=3D"font-family: Courier; color: rgb(30, 73, = 125);">Albert Lewis</span></b><span style=3D"font-family: Courier; = color: rgb(30, 73, 125);"><o:p></o:p></span></div><div style=3D"margin: = 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-family: Courier; color: rgb(153, 153, 153);">Email:<span = class=3D"Apple-converted-space"> </span></span><u><span = style=3D"font-family: Courier; color: rgb(128, 27, 128);"><a = href=3D"mailto:[email protected]" style=3D"color: blue; text-decoration: = underline;"><span style=3D"color: rgb(128, 27, = 128);">[email protected]</span></a></span></u><span style=3D"font-family: = Courier; color: rgb(79, 129, 189);"> </span><span style=3D"font-size:= 11.5pt; font-family: Courier; color: rgb(127, 127, = 127);"><o:p></o:p></span></div></div><div class=3D"MsoNormal" = align=3D"center" style=3D"margin: 0in; font-size: 12pt; font-family: = Aptos, sans-serif; text-align: center;"><hr size=3D"2" width=3D"98%" = align=3D"center"></div><div id=3D"divRplyFwdMsg"><div style=3D"margin: = 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><b><span = style=3D"font-size: 11pt; font-family: Calibri, = sans-serif;">From:</span></b><span style=3D"font-size: 11pt; = font-family: Calibri, sans-serif;"><span = class=3D"Apple-converted-space"> </span>Snort-users <<a = href=3D"mailto:[email protected]" style=3D"color: = blue; text-decoration: = underline;">[email protected]</a>> on behalf of Al = Lewis (allewi) via Snort-users <<a = href=3D"mailto:[email protected]" style=3D"color: blue; = text-decoration: = underline;">[email protected]</a>><br><b>Sent:</b><span = class=3D"Apple-converted-space"> </span>Thursday, October 23, 2025 = 1:31 PM<br><b>To:</b><span class=3D"Apple-converted-space"> </span><a= href=3D"mailto:[email protected]" style=3D"color: blue; = text-decoration: underline;">[email protected]</a><span = class=3D"Apple-converted-space"> </span><<a = href=3D"mailto:[email protected]" style=3D"color: blue; = text-decoration: underline;">[email protected]</a>>; David = Melczer <<a href=3D"mailto:[email protected]" style=3D"color: = blue; text-decoration: = underline;">[email protected]</a>><br><b>Subject:</b><span = class=3D"Apple-converted-space"> </span>Re: [Snort-users] Request = for configuration assistance</span><o:p></o:p></div><div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"> <o:p></o:p></div></div></div><div><div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-family: "Courier New";">Do = you have a sample of the traffic that is alerting (with the suppression = in place) that you can share?<o:p></o:p></span></div></div><div = id=3D"x_Signature"><div><div style=3D"margin: 0in; font-size: 12pt; = font-family: Aptos, sans-serif;"><span style=3D"font-family: = "Courier = New";"><o:p> </o:p></span></div></div><p><b><span = style=3D"font-family: Courier; color: rgb(30, 73, 125);">Albert = Lewis</span></b><span style=3D"font-family: Courier; color: rgb(30, 73, = 125);"><o:p></o:p></span></p><p><span style=3D"font-family: Courier; = color: rgb(153, 153, 153);">Email:<span = class=3D"Apple-converted-space"> </span></span><u><span = style=3D"font-family: Courier; color: rgb(128, 27, 128);"><a = href=3D"mailto:[email protected]" style=3D"color: blue; text-decoration: = underline;"><span style=3D"color: rgb(128, 27, = 128);">[email protected]</span></a></span></u><span style=3D"font-family: = Courier; color: rgb(79, 129, 189);"> </span><span style=3D"font-size:= 11.5pt; font-family: Courier; color: rgb(127, 127, = 127);"><o:p></o:p></span></p></div><div class=3D"MsoNormal" = align=3D"center" style=3D"margin: 0in; font-size: 12pt; font-family: = Aptos, sans-serif; text-align: center;"><hr size=3D"2" width=3D"98%" = align=3D"center"></div><div id=3D"x_divRplyFwdMsg"><div style=3D"margin: = 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><b><span = style=3D"font-size: 11pt; font-family: Calibri, = sans-serif;">From:</span></b><span style=3D"font-size: 11pt; = font-family: Calibri, sans-serif;"><span = class=3D"Apple-converted-space"> </span>Snort-users <<a = href=3D"mailto:[email protected]" style=3D"color: = blue; text-decoration: = underline;">[email protected]</a>> on behalf of = David Melczer via Snort-users <<a = href=3D"mailto:[email protected]" style=3D"color: blue; = text-decoration: = underline;">[email protected]</a>><br><b>Sent:</b><span = class=3D"Apple-converted-space"> </span>Thursday, October 23, 2025 = 12:46 PM<br><b>To:</b><span = class=3D"Apple-converted-space"> </span><a = href=3D"mailto:[email protected]" style=3D"color: blue; = text-decoration: underline;">[email protected]</a><span = class=3D"Apple-converted-space"> </span><<a = href=3D"mailto:[email protected]" style=3D"color: blue; = text-decoration: = underline;">[email protected]</a>><br><b>Subject:</b><span = class=3D"Apple-converted-space"> </span>[Snort-users] Request for = configuration assistance</span><o:p></o:p></div><div><div style=3D"margin:= 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"> <o:p></o:p></div></div></div><div><div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-size: 11pt;">Good = day.</span><o:p></o:p></div><div style=3D"margin: 0in; font-size: 12pt; = font-family: Aptos, sans-serif;"><span style=3D"font-size: = 11pt;"> </span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt;">We have a Snort3 sensor running<span = class=3D"Apple-converted-space"> </span><a href=3D"http://3.9.6.0/" = style=3D"color: blue; text-decoration: underline;">3.9.6.0</a><span = class=3D"Apple-converted-space"> </span>with the ETOPEN = ruleset. The sensor runs on Debian 13, if that is relevant. = Every time we go to image one of our laptops, we get several hundred ET = alerts despite the fact that I have what I believe is the proper = suppression rules set in SNORT.LUA (the IP address of the machine = generating these alerts is 172.19.8.25). Here is what I believe to = be a relevant clip:</span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt;"> </span><o:p></o:p></div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-size: 11pt; font-family: "Courier = New";">--------------------------------------------------------------= ------------</span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt; font-family: "Courier New";">-- 6. = configure filters</span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt; font-family: "Courier = New";">--------------------------------------------------------------= -------------</span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt; font-family: "Courier = New";"> </span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt; font-family: "Courier New";">include = 'et_thresholds.lua'</span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt; font-family: "Courier = New";"> </span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt; font-family: "Courier New";">-- = below are examples of filters</span><o:p></o:p></div><div style=3D"margin:= 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt; font-family: "Courier New";">-- each = table is a list of records</span><o:p></o:p></div><div style=3D"margin: = 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt; font-family: "Courier = New";"> </span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt; font-family: "Courier = New";">suppress =3D</span><o:p></o:p></div><div style=3D"margin: = 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt; font-family: "Courier = New";">{</span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt; font-family: "Courier = New";"> -- don't want to any of see = these</span><o:p></o:p></div><div style=3D"margin: 0in; font-size: 12pt; = font-family: Aptos, sans-serif;"><span style=3D"font-size: 11pt; = font-family: "Courier New";"> <span = class=3D"Apple-converted-space"> </span><span style=3D"background: = yellow;">{ track =3D 'by_src', ip =3D '172.19.8.25' = },</span></span><o:p></o:p></div><div style=3D"margin: 0in; font-size: = 12pt; font-family: Aptos, sans-serif;"><span style=3D"font-size: 11pt; = font-family: "Courier New"; background: = yellow;"> { track =3D 'by_dst', ip =3D '172.19.8.25' = },</span><o:p></o:p></div><div style=3D"margin: 0in; font-size: 12pt; = font-family: Aptos, sans-serif;"><span style=3D"font-size: 11pt; = font-family: "Courier New";">=E2=80=A6</span><o:p></o:p></div><d= iv style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-size: 11pt; font-family: "Courier = New";">}</span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt;"> </span><o:p></o:p></div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-size: 11pt;">I=E2=80=99ve tried = different syntax that I=E2=80=99ve seen online, = including:</span><o:p></o:p></div><div style=3D"margin: 0in; font-size: = 12pt; font-family: Aptos, sans-serif;"><span style=3D"font-size: = 11pt;"> </span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt; font-family: "Courier = New";"> <span = class=3D"Apple-converted-space"> </span><span style=3D"background: = yellow;">{ gid =3D 0, sid =3D 0, track =3D 'by_src', ip =3D = '172.19.8.25' },</span></span><o:p></o:p></div><div style=3D"margin: = 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt; font-family: "Courier New"; = background: yellow;"> { gid =3D 0, sid =3D 0, track =3D = 'by_dst', ip =3D '172.19.8.25' },</span><o:p></o:p></div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-size: = 11pt;"> </span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt;">It would appear though that nothing I do = suppresses error messages from this IP=E2=80=A6</span><o:p></o:p></div><di= v style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-size: = 11pt;"> </span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt;">Does anyone have any idea how I might be able = to accomplish this?</span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt;"> </span><o:p></o:p></div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-size: 11pt;">Thank you very much in = advance for any assistance you can provide.</span><o:p></o:p></div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-size: = 11pt;"> </span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt;">-Dave</span><o:p></o:p></div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-size: = 11pt;"> </span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><b><span = style=3D"font-size: 11pt; font-family: "Arial Narrow", = sans-serif; color: rgb(29, 81, 131);">David Z. Melczer <span = class=3D"Apple-converted-space"> </span></span></b><span = style=3D"font-size: 11pt; font-family: "Univers LT Std 57 Cn"; = color: rgb(83, 129, 53);">|</span><span style=3D"font-size: 11pt; = font-family: "Arial Narrow", sans-serif; color: rgb(31, 73, = 125);"><span class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 9pt; font-family: "Arial Narrow", = sans-serif; color: rgb(31, 73, 125);">Director of Information = Technology</span><o:p></o:p></div><div style=3D"margin: 0in; font-size: = 12pt; font-family: Aptos, sans-serif; line-height: 11.5pt;"><b><span = style=3D"font-size: 3pt; font-family: "Arial Narrow", = sans-serif; color: rgb(31, 73, = 125);"> </span></b><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif; line-height: = 11.5pt;"><b><span style=3D"font-size: 10pt; font-family: "Arial = Narrow", sans-serif; color: rgb(31, 73, 125);">Greenbaum, Rowe, = Smith & Davis LLP</span></b><o:p></o:p></div><div style=3D"margin: = 0in; font-size: 12pt; font-family: Aptos, sans-serif; line-height: = 11.5pt;"><span style=3D"font-size: 10pt; font-family: "Arial = Narrow", sans-serif; color: rgb(31, 73, 125);">Delivery: 99 Wood = Avenue South<span = class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Univers LT Std 57 Cn"; = color: rgb(83, 129, 53);">|</span><span style=3D"font-size: 10pt; = font-family: "Arial Narrow", sans-serif; color: rgb(31, 73, = 125);"><span class=3D"Apple-converted-space"> </span>Iselin, = NJ<span class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(83, 129, 53);">|</span><span style=3D"font-size: = 10pt; font-family: "Arial Narrow", sans-serif; color: rgb(31, = 73, 125);"><span = class=3D"Apple-converted-space"> </span>08830</span><o:p></o:p></div>= <div style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif; line-height: 11.5pt;"><span style=3D"font-size: 10pt; = font-family: "Arial Narrow", sans-serif; color: rgb(31, 73, = 125);">Mailing: P.O. Box 5600<span = class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(83, 129, 53);">|</span><span style=3D"font-size: = 10pt; font-family: "Arial Narrow", sans-serif; color: rgb(31, = 73, 125);"><span class=3D"Apple-converted-space"> </span>Woodbridge, = NJ<span class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(83, 129, 53);">|</span><span style=3D"font-size: = 10pt; font-family: "Arial Narrow", sans-serif; color: rgb(31, = 73, 125);"><span = class=3D"Apple-converted-space"> </span>07095</span><o:p></o:p></div>= <div style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif; line-height: 11.5pt;"><span style=3D"font-size: 10pt; = font-family: "Arial Narrow", sans-serif; color: rgb(31, 73, = 125);">T:</span><span style=3D"font-size: 11pt; color: rgb(31, 73, = 125);"><span class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(31, 73, 125);">732.476.3284</span><span = style=3D"font-size: 11pt; color: rgb(31, 73, 125);"><span = class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(31, 73, 125);"> </span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(83, 129, 53);">|<span = class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(31, 73, 125);"> F:</span><span = style=3D"font-size: 11pt; color: rgb(31, 73, 125);"><span = class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(31, 73, 125);">732.476.3285 <span = class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(83, 129, 53);">|<span = class=3D"Apple-converted-space"> </span></span><span = style=3D"font-size: 10pt; font-family: "Arial Narrow", = sans-serif; color: rgb(29, 81, 131);"> </span><span = style=3D"font-size: 11pt; color: rgb(31, 73, 125);"><a = href=3D"http://www.greenbaumlaw.com/vcard-1999.vcf" style=3D"color: = blue; text-decoration: underline;"><span style=3D"font-size: 10pt; = font-family: "Arial Narrow", sans-serif; color: rgb(29, 81, = 131);">vCard</span></a></span><o:p></o:p></div><div style=3D"margin: = 0in; font-size: 12pt; font-family: Aptos, sans-serif; line-height: = 10pt;"><span style=3D"font-size: 4pt; font-family: "Arial = Narrow", sans-serif; color: rgb(29, 81, = 131);"> </span><o:p></o:p></div><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 9pt; font-family: "Arial Narrow", = sans-serif; color: rgb(31, 73, 125);"><span = id=3D"cid:[email protected]"><image001.jpg></span></spa= n><o:p></o:p></div><table class=3D"MsoNormalTable" border=3D"0" = cellspacing=3D"0" cellpadding=3D"0" style=3D"margin-left: 0.7pt; = border-collapse: collapse;"><tbody><tr style=3D"height: 0.2in;"><td = width=3D"144" style=3D"width: 1.5in; padding: 0in 0.7pt; height: = 0.2in;"><div style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"><span style=3D"font-size: 11pt; color: rgb(31, 73, = 125);"><a href=3D"http://www.greenbaumlaw.com/" style=3D"color: blue; = text-decoration: underline;"><span style=3D"font-size: 12pt; = font-family: "Arial Narrow", sans-serif; color: rgb(237, 125, = 49);">greenbaumlaw.com</span></a></span><u><span style=3D"font-family: = "Arial Narrow", sans-serif; color: rgb(83, 129, = 53);"></span></u><o:p></o:p></div></td><td width=3D"18" style=3D"width: = 13.5pt; padding: 0in 0.7pt; height: 0.2in;"><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><a = href=3D"https://www.linkedin.com/company/greenbaum-rowe-smith-&-davis-= llp?trk=3Dtop_nav_home" style=3D"color: blue; text-decoration: = underline;"><span style=3D"font-size: 11pt; font-family: "Arial = Narrow", sans-serif; color: rgb(31, 73, 125); text-decoration: = none;"><span = id=3D"cid:[email protected]"><image002.png></span></spa= n></a><o:p></o:p></div></td><td width=3D"18" style=3D"width: 13.5pt; = padding: 0in 0.7pt; height: 0.2in;"><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><a = href=3D"https://twitter.com/greenbaumlaw" style=3D"color: blue; = text-decoration: underline;"><span style=3D"font-size: 11pt; = font-family: "Arial Narrow", sans-serif; color: rgb(31, 73, = 125); text-decoration: none;"><span = id=3D"cid:[email protected]"><image003.png></span></spa= n></a><o:p></o:p></div></td><td width=3D"18" style=3D"width: 13.5pt; = padding: 0in 0.7pt; height: 0.2in;"><div style=3D"margin: 0in; = font-size: 12pt; font-family: Aptos, sans-serif;"><a = href=3D"https://www.facebook.com/greenbaumlaw?fref=3Dts&ref=3Dbr_tf" = style=3D"color: blue; text-decoration: underline;"><span = style=3D"font-size: 11pt; font-family: "Arial Narrow", = sans-serif; color: rgb(31, 73, 125); text-decoration: none;"><span = id=3D"cid:[email protected]"><image004.png></span></spa= n></a><o:p></o:p></div></td></tr></tbody></table><div style=3D"margin: = 0in; font-size: 12pt; font-family: Aptos, sans-serif;"><span = style=3D"font-size: 11pt;"> </span><o:p></o:p></div><div = style=3D"margin: 0in; font-size: 12pt; font-family: Aptos, = sans-serif;"> <o:p></o:p></div></div><p class=3D"MsoNormal" = style=3D"margin: 0in 0in 12pt; font-size: 12pt; font-family: Aptos, = sans-serif;"><o:p> </o:p></p><p><b><span style=3D"font-size: 10pt; = font-family: Verdana, sans-serif; color: rgb(102, 102, = 102);">Disclaimer</span></b><span style=3D"font-size: 10pt; font-family: = Verdana, sans-serif; color: rgb(102, 102, = 102);"><o:p></o:p></span></p><p><span style=3D"font-size: 8pt; = font-family: Verdana, sans-serif; color: rgb(102, 102, 102);">This = e-mail (including any attachments) is intended only for the exclusive = use of the individual to whom it is addressed. The information contained = hereinafter may be proprietary, confidential, privileged and exempt from = disclosure under applicable law. If the reader of this e-mail is not the = intended recipient or agent responsible for delivering the message to = the intended recipient, the reader is hereby put on notice that any use, = dissemination, distribution or copying of this communication is strictly = prohibited. If the reader has received this communication in error, = please immediately notify the sender by telephone (732-549-5600) or = e-mail and delete all copies of this e-mail and any attachments. Thank = you.<o:p></o:p></span></p></div></div></div><br style=3D"caret-color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><br style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><p style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: auto; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; widows: auto; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Verdana; font-size: 10pt; color: rgb(102, 102, = 102);"><b>Disclaimer</b></p><p style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: auto; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; widows: auto; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; font-family: = Verdana; font-size: 8pt; color: rgb(102, 102, 102);">This e-mail = (including any attachments) is intended only for the exclusive use of = the individual to whom it is addressed. The information contained = hereinafter may be proprietary, confidential, privileged and exempt from = disclosure under applicable law. If the reader of this e-mail is not the = intended recipient or agent responsible for delivering the message to = the intended recipient, the reader is hereby put on notice that any use, = dissemination, distribution or copying of this communication is strictly = prohibited. If the reader has received this communication in error, = please immediately notify the sender by telephone (732-549-5600) or = e-mail and delete all copies of this e-mail and any attachments. Thank = you.</p><span style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline = !important;">_______________________________________________</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;">Snort-users mailing list</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;">[email protected]</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;">Go to this URL to change user options or = unsubscribe:</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;"><span style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline = !important;">https://lists.snort.org/mailman/listinfo/snort-users</span><b= r style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><span = class=3D"Apple-tab-span" style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;"> </span><span style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;">To unsubscribe, send an = email to:</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;"><span class=3D"Apple-tab-span" style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;"> </span><span style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline = !important;">[email protected]</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;">Please visit http://blog.snort.org to stay = current on all the latest Snort news!</span><br style=3D"caret-color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><br style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><span style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline !important;">Please = follow these rules: = https://snort.org/faq/what-is-the-mailing-list-etiquette</span></div></blo= ckquote></div><br></body></html>= --Apple-Mail=_AAAB8FE0-5CFA-4355-94BE-DE28DC7C96F9-- --===============0674376039563337691== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --===============0674376039563337691==--