Thank you for the quick response! Can you give me an example about "change the rules to use the "drop" action"? Thanks. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20130312/a44b530a/attachment-0002.html>