Snort.org home  
Got Source? About Snort About Sourcefire Snort FAQ
Sourcefire Network Security - the creators of Snort

Snort Forums Archive

Archive Home » Rules » Thresholding or supressing an event

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Thresholding or supressing an event


Posted by mishka on March 21, 2005 04:01:57

I have problems with a particular event: gen_id 122 s_id 27 - (portscan) open port.

I cannot remove this one from my lists. I have tried everything.
Can anybody help ?