Re: track by_src/dst

[wkitty42 () windstream net]

On 11/06/2015 02:38 PM, Jefferson, Shawn wrote:
> Hi,
>
> I believe you use brackets.  [1.1.1.1,2.2.2.2]
>
> I don't think duplicate threshold lines work and throw an error, but I could be wrong, going from memory on that.

multiple lines with different single IP addresses each have been working fine 
over here with over 2000 entries in threshold.conf... many of them for akamai's 
mess of addresses ;)

-- 
  NOTE: No off-list assistance is given without prior approval.
        *Please keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.

------------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!