Re: Using snort-2.9.8.3.How to connect mariadb with a path like the following ?

[wkitty42 () windstream net]

On 10/22/2016 07:17 AM, 张欣悦 wrote:
[...]
> vim /etc/snort/rules/black_list.rules
>
> # black_list
>
> alert icmp 192.168.246.254/32 any -> 192.168.246.0/24 any (msg:"ICMP packets
> ";sid:999; rev:666;)
>
>
> vim /etc/snort/rules/white_list.rules
>
> #white_list
>
> alert icmp any any -> any any (msg:"ICMP packets permited!"; sid:900; rev: 600;)

additionally, white and black list rules used with the Reputation PreProcessor 
(aka RPP) are /not/ normal snort rules... they are simply lists of IP numbers... 
your two files above will cause snort to fail if they are for use with the RPP...

-- 
  NOTE: No off-list assistance is given without prior approval.
        *Please keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!