<div dir="ltr">Re suricon2017, will there be any stateside cons for suri in 2017? I would be hard pressed to find a way to get my employer to send me to Europe. :)<div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Feb 23, 2017 at 12:00 PM, <span dir="ltr"><<a href="mailto:oisf-users-request@lists.openinfosecfoundation.org" target="_blank">oisf-users-request@lists.openinfosecfoundation.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send Oisf-users mailing list submissions to<br>
<a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.<wbr>openinfosecfoundation.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oisf-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:oisf-users-request@lists.openinfosecfoundation.org">oisf-users-request@lists.<wbr>openinfosecfoundation.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:oisf-users-owner@lists.openinfosecfoundation.org">oisf-users-owner@lists.<wbr>openinfosecfoundation.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Oisf-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: duplicate signature (Vieri)<br>
2. ANNOUNCING SuriCon 2017 - November 15 - 17 (Kelley Misata)<br>
<br>
<br>
------------------------------<wbr>------------------------------<wbr>----------<br>
<br>
Message: 1<br>
Date: Thu, 23 Feb 2017 08:12:20 +0000 (UTC)<br>
From: Vieri <<a href="mailto:rentorbuy@yahoo.com">rentorbuy@yahoo.com</a>><br>
To: Oisf-users <<a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.<wbr>openinfosecfoundation.org</a>><br>
Subject: Re: [Oisf-users] duplicate signature<br>
Message-ID: <<a href="mailto:318153291.4357078.1487837540913@mail.yahoo.com">318153291.4357078.<wbr>1487837540913@mail.yahoo.com</a>><br>
Content-Type: text/plain; charset=UTF-8<br>
<br>
<br>
<br>
----- Original Message -----<br>
<br>
From: Victor Julien <<a href="mailto:lists@inliniac.net">lists@inliniac.net</a>><br>
>> # grep 5000001 /etc/suricata/rules/*<br>
>> /etc/suricata/rules/local.<wbr>rules:drop ip $EXTERNAL_NET any -> $HOME_NET any (msg:"obnoxious GeoIP block"; geoip:src,!US,CA,EU,ES,PT,FR,<wbr>DE,GB,IT,BE; sid:5000001; rev:1;)<br>
><br>
> Could you be loading the same rule file twice?<br>
<br>
<br>
Right. My bad. I wrongly included the file twice.<br>
<br>
By the way, the negating rule example in<br>
<a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/GeoIP" rel="noreferrer" target="_blank">https://redmine.<wbr>openinfosecfoundation.org/<wbr>projects/suricata/wiki/GeoIP</a> should be used with care. Never use that with alert/drop ip any any -> any any or the system will come to a crawl with 100% CPU. I guess that's because the suricata equivalent of "geoiplookup <private_ip>" evaluates to true when using ! in the rule.<br>
<br>
Maybe the line that reads:<br>
geoip:src,!ES,JP,US,UK,PT;sid:<wbr>1; --> this will trigger if src IP of the packet is not ES or JP or US or UK or PT<br>
should be changed to:<br>
geoip:src,!ES,JP,US,GB,PT;sid:<wbr>1; --> this will trigger if src IP of the packet is not ES or JP or US or GB or PT or if it's in a private address range<br>
<br>
(note that UK doesn't exist - it could be either GB, United Kingdom or UA, Ukraine)<br>
<br>
Vieri<br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Thu, 23 Feb 2017 09:11:23 -0500<br>
From: Kelley Misata <<a href="mailto:kmisata@oisf.net">kmisata@oisf.net</a>><br>
To: oisf users <<a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@<wbr>openinfosecfoundation.org</a>><br>
Subject: [Oisf-users] ANNOUNCING SuriCon 2017 - November 15 - 17<br>
Message-ID:<br>
<<a href="mailto:CAEoU0e_nwLztxhGsEtZziiFzMKTq7kp5o7-YMRyT4UR5TEZy5A@mail.gmail.com">CAEoU0e_<wbr>nwLztxhGsEtZziiFzMKTq7kp5o7-<wbr>YMRyT4UR5TEZy5A@mail.gmail.com</a><wbr>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
We are excited to announce the dates and location for the 3rd annual<br>
Suricata uses conference - *SuriCon 2017... mark your calendars and<br>
register early as SuriCon has sold out 2 years in a row!*<br>
<br>
November 15 - 17, 2017<br>
Hotel Grandior Prague, Na Poříčí 42, 110 00 Praha 1-Florenc, Czechia<br>
Register <<a href="https://suricon2017.eventbrite.com/" rel="noreferrer" target="_blank">https://suricon2017.<wbr>eventbrite.com/</a>><br>
<br>
As many of you know SuriCon every year brings together the Suricata<br>
community from across the globe for 3-days of talks, dev-roadmap<br>
discussions, and maybe even some beer.<br>
<br>
*"Strong friendly community, technical focus, a wide range of talks." *<br>
*SuriCon 2016 Attendee*<br>
<br>
*Interested in speaking at SuriCon? *<br>
Get your abstracts ready, call for speakers opens March 1, 2017.<br>
<br>
*Show your support of Suricata and SuriCon - become a sponsor! *<br>
SuriCon is possible only with the generous support of our sponsors.<br>
Considering supporting SurCon and the Suricata community by becoming a<br>
sponsor today. Also, thanks to great feedback from last year's sponsors and<br>
attendees we have added a few new levels AND new benefits. Space for some<br>
sponsorships is limited so don't wait. Check it out!<br>
<<a href="http://suricon.net/sponsorship/" rel="noreferrer" target="_blank">http://suricon.net/<wbr>sponsorship/</a>><br>
<br>
<br>
See you in Prague!<br>
The OISF Team<br>
<br>
--<br>
*Kelley Misata, Ph.D.*<br>
*Executive Director*<br>
*<a href="mailto:kmisata@oisf.net">kmisata@oisf.net</a> <<a href="mailto:kmisata@oisf.net">kmisata@oisf.net</a>>*<br>
*twitter:@OISFoundation*<br>
*<a href="http://www.oisf.net" rel="noreferrer" target="_blank">www.oisf.net</a> <<a href="http://www.oisf.net" rel="noreferrer" target="_blank">http://www.oisf.net</a>>*<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170223/c0b0c439/attachment-0001.html" rel="noreferrer" target="_blank">http://lists.<wbr>openinfosecfoundation.org/<wbr>pipermail/oisf-users/<wbr>attachments/20170223/c0b0c439/<wbr>attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
______________________________<wbr>_________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@lists.openinfosecfoundation.org">Oisf-users@lists.<wbr>openinfosecfoundation.org</a><br>
<a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oisf-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of Oisf-users Digest, Vol 87, Issue 29<br>
******************************<wbr>************<br>
</blockquote></div><br></div>