<br><br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><font><span style="font-family:courier new,monospace"> Sorry for my poor English.<br><br>
I just want take it for an example. I know if my HOME_NET is <a href="http://192.168.0.0/16" target="_blank">192.168.0.0/16</a>. I can set it to HOME_NET [<a href="http://192.168.0.0/16,!192.168.0.10" target="_blank">192.168.0.0/16,!192.168.0.10</a>]. So, any rule may not be detected for 192.168.0.10. But this is not I am expected. I still want most of rules to protect that server.<br>
<br> I mean, if some rules alert and drop a packet for a mistake, we may disable that rule. But if we do so, all other ip in my home net may not be protected by this rule.<br><br> So, my question is , can I just disable some rules for specific ip ?<br>
<br> I know I can change these rules’ Source and destination Address one by one. But it’s too hard if the number of the rules is very large.<br> I want to known whether I can simply set a configure file like following to do this thing. Or can some external plug-in module do this job?<br>
<br>The first is ip. The following is the sid should exclude for the ip.<br>192.168.0.10 2000001,2000002-2000005,2000006<br><a href="http://192.168.0.0/24" target="_blank">192.168.0.0/24</a> 2000007,2000008<br><br>Thanks.</span><br>
</font><div class="HOEnZb"><div class="h5"><br>
<div class="gmail_quote">2012/10/17 Peter Manev <span dir="ltr"><<a href="mailto:petermanev@gmail.com" target="_blank">petermanev@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br><br>What is your home net variable ?<br>and could you share the rule?<br><br>thank you<br><br><div class="gmail_quote"><div><div>On Wed, Oct 17, 2012 at 5:09 AM, Ö£²©ÎÄ <span dir="ltr"><<a href="mailto:anshuitian@gmail.com" target="_blank">anshuitian@gmail.com</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div>I'm sorry, the picture is bad. <br><div><div><br><br><br><div class="gmail_quote">
2012/10/17 Ö£²©ÎÄ <span dir="ltr"><<a href="mailto:anshuitian@gmail.com" target="_blank">anshuitian@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello everybody: <br> <span lang="en"><span>I recently</span> <span>learned</span> <span>suricata. </span><span>now, I</span> <span>using</span> <span>suricata by IPS mode</span> <span>to</span> <span>protect</span> <span>two servers</span> <span>(192.168.0.10</span> <span>and</span> <span>192.168.0.11)</span><span>,</span> <span>but</span><span> I</span> <span>want to set</span> <span>rule </span><span>that id is 200,001</span> <span>doesn't works to</span> <span>192.168.0.10</span><span>,</span> <span>but works to</span> <span>192.168.0.11</span><span></span><span>. What should I do? If there are many rules like 200,001, What should I do? <br>
<br> There is my <span lang="en"><span>topology: <br></span></span></span></span><br><div style="text-align:center"><img src="" alt=""><br>
<br><br><br><div style="text-align:left"> <br> Thanks very much!<br></div></div>
</blockquote></div><br>
</div></div><br></div></div>_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
<a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br></blockquote></div><span><font color="#888888"><br><br clear="all"><br>-- <br><div>Regards,</div>
<div>Peter Manev</div><br>
</font></span></blockquote></div><br>
</div></div></blockquote></div><br>