<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="GENERATOR" content="GtkHTML/4.6.5">
</head>
<body>
Victor, <br>
<br>
/usr/bin/suricata -c /etc/suricata/suricata-debian.yaml --pidfile /var/run/suricata.pid -q 0 -D<br>
<br>
I use 1.2.1-2 from Debian distribution - missed it in previous messages.<br>
<br>
В Пн, 22/07/2013 в 09:27 +0200, Victor Julien пишет:
<blockquote type="CITE">
<pre>
On 07/17/2013 02:28 PM, Kirill Sluchanko wrote:
<font color="#737373">> OK, let's start from the other end.</font>
<font color="#737373">> </font>
<font color="#737373">> My task is to remove alerts for some rule from unified2.alerts as these</font>
<font color="#737373">> alerts uselessly poisoning Snorby's database. </font>
<font color="#737373">> </font>
<font color="#737373">> As I got no replies on previous message I've tried to experiment with</font>
<font color="#737373">> threshold settings. First of all I've enabled drop.log (as, for some</font>
<font color="#737373">> reasons, it is the only way I can use to find if the packets are</font>
<font color="#737373">> dropped).</font>
<font color="#737373">> </font>
<font color="#737373">> Then I've enabled threshold file in suricata.yaml and create</font>
<font color="#737373">> threshold.config with following content:</font>
<font color="#737373">> </font>
<font color="#737373">> suppress gen_id 1, sig_id 2200075</font>
<font color="#737373">> </font>
<font color="#737373">> Restart Suricata - and first try failed. Too few records in drop.log. I</font>
<font color="#737373">> think it means that packets matching the rule is not dropped - and when</font>
<font color="#737373">> I have commented the string above and restarted Suricata, drop.log shows</font>
<font color="#737373">> that packets of interest are dropping.</font>
<font color="#737373">> </font>
<font color="#737373">> Well, let's try another way - I have changed content of threshold.conf</font>
<font color="#737373">> to following string:</font>
<font color="#737373">> </font>
<font color="#737373">> threshold gen_id 1, sig_id 2200075, type threshold, track by_src,</font>
<font color="#737373">> count 1000, seconds 1000</font>
<font color="#737373">> </font>
<font color="#737373">> Restart Suricata - still no luck; drop.log shows that nothing is</font>
<font color="#737373">> dropped. Comment the string and restart Suricata - drop.log shows that</font>
<font color="#737373">> packets are dropping.</font>
<font color="#737373">> </font>
<font color="#737373">> The question is - what's wrong with my approach? Or maybe it is</font>
<font color="#737373">> something wrong with Suricata? For example, I suspect that 'suppress' or</font>
<font color="#737373">> 'threshold' usage can influence dropped packets logging.</font>
How are you starting Suricata?
</pre>
</blockquote>
</body>
</html>