<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>so if my filter file gets updated, would I have to restart suricata service or rule-reload would refresh it?<br><br>Thanks for detailed explanation.<br><br><div>> Date: Thu, 26 Jun 2014 12:30:26 -0700<br>> From: cnelson@ucsd.edu<br>> To: coolyasha@hotmail.com; oisf-users@lists.openinfosecfoundation.org<br>> Subject: Re: [Oisf-users] Suppress all signatures per source IP<br>> <br>> -----BEGIN PGP SIGNED MESSAGE-----<br>> Hash: SHA1<br>> <br>> Again, the right way to do this is via bpf filters. That way the<br>> packets are efficiently filtered by the kernel.<br>> <br>> Just start suricata with 'not host 111.222.111.222' on the command line.<br>> <br>> If you are going to need a large list, use a filter file specified by<br>> the -F command line argument.<br>> <br>> Bpf filter syntax is explained here:<br>> <br>> > http://biot.com/capstats/bpf.html<br>> <br>> - -Coop<br>> <br>> On 6/26/2014 12:23 PM, Yasha Zislin wrote:<br>> > Is there a way to use threshold.conf to suppress all signatures coming<br>> > from unique source IP address?<br>> > <br>> > Something like this:<br>> > suppress gen_id 0, sig_id 0, track by_src, ip 111.222.111.222<br>> > <br>> > Or is there another way of doing this? I want basically to whitelist<br>> > some IPs so no rules apply to them.<br>> > <br>> > Thanks.<br>> > <br>> > <br>> > _______________________________________________<br>> > Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> > Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>> > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> > OISF: http://www.openinfosecfoundation.org/<br>> > <br>> <br>> <br>> - -- <br>> Cooper Nelson<br>> Network Security Analyst<br>> UCSD ACT Security Team<br>> cnelson@ucsd.edu x41042<br>> -----BEGIN PGP SIGNATURE-----<br>> Version: GnuPG v2.0.17 (MingW32)<br>> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/<br>> <br>> iQEcBAEBAgAGBQJTrHTSAAoJEKIFRYQsa8FWk9sH/2/hkKRC/crzvU3O4dCz8RVG<br>> USk0MBcXPmxUSNZt1G1JHxJ9ky7K7ZNTo5pfDc47342kPcCO3plM03VujpSoEQjf<br>> Zva6SKCTwo8ZzfgjaWQniUzHs3tQMCQ6CPtOKoR8sgwy9o5jduA01ucyUuJyhGI1<br>> GZ2FMiCekV8LPu/fjC3gASTE2kUlSQ0RQJlhYOHJuVxR7lugV1WfIvEIDxItYTFx<br>> hMdR1PfSm4u2JCkpAqZ1TIO2RmoaxcRFPy+NcInIg6zryQwU280qDSMaBSFrakhX<br>> ZqV5IXW0acvKPumtQOdQxz80pDoaHXvkOeMxoDerkU1UR8KSwiyfcX0ynh2pakM=<br>> =wER8<br>> -----END PGP SIGNATURE-----<br></div> </div></body>
</html>