<![CDATA[CIDR in suppress list not showing in Alerts pane]]>At present, when specifying a src\dst host IP for a suppress list entry, this is indicated with any alert for that SID by replacing the small "+" sign (located under the 2nd octet) with a small checkbox. When specifying a CIDR block instead of a host IP, no such checkbox is shown and the "+" sign remains thereby not indicating that a suppress entry exists for that SID.

Can this be changed so that the checkbox is shown when either a host IP or subnet are provided in the suppress list?

]]>https://forum.netgate.com/topic/131354/cidr-in-suppress-list-not-showing-in-alerts-paneRSS for NodeWed, 07 Oct 2026 10:03:49 GMTTue, 29 May 2018 04:49:01 GMT60<![CDATA[Reply to CIDR in suppress list not showing in Alerts pane on Tue, 29 May 2018 23:08:29 GMT]]>@nogbadthebad I wanna assume good faith here and that you're trying to help - but please try and not fall into the trap of first failing to read the OP, then insisting on a non-solution, followed by complete ignoring the OP altogether. I understand how to submit FRs - not my purpose here. Simply ignore the thread if you have nothing assistive to add.

Thanks.

]]>https://forum.netgate.com/post/768648https://forum.netgate.com/post/768648Tue, 29 May 2018 23:08:29 GMT<![CDATA[Reply to CIDR in suppress list not showing in Alerts pane on Tue, 29 May 2018 23:02:13 GMT]]>Put a request in via redmine then, thats the correct method to get changes.

]]>https://forum.netgate.com/post/768646https://forum.netgate.com/post/768646Tue, 29 May 2018 23:02:13 GMT<![CDATA[Reply to CIDR in suppress list not showing in Alerts pane on Tue, 29 May 2018 22:43:33 GMT]]>No - you clearly do not understand what I am asking. I'm not asking for any change in the suppress rule addition function and nowhere in my OP does it indicate that. What I am asking about is strictly a GUI symbol visibility change.

For some unknown reason, you seem to think I am asking for subnet suppress rule to be added - no idea where you're getting that but again, not remotely my question...

And of course it's possible because the system at present checks against subnet rules - so that logic is already there. All that would need to be done is tell the GUI to indicate when a subnet rule applies to a given alert exactly the same way as it does right now for a host rule.

]]>https://forum.netgate.com/post/768639https://forum.netgate.com/post/768639Tue, 29 May 2018 22:43:33 GMT<![CDATA[Reply to CIDR in suppress list not showing in Alerts pane on Tue, 29 May 2018 22:32:51 GMT]]>I understand exactly what your saying, you cant do what you want, it's not in the Snort GUI.

Snort sees the alert from an IP address not a subnet.

The only way to do it is edit the suppress entry after creating it with the src or dst being an IP address NOT a subnet.

If you want to change the way the GUI works create a feature request in redmine:-

https://redmine.pfsense.org/projects/pfsense

Bill Meeks is the Snort / Suricata guy.

]]>https://forum.netgate.com/post/768633https://forum.netgate.com/post/768633Tue, 29 May 2018 22:32:51 GMT<![CDATA[Reply to CIDR in suppress list not showing in Alerts pane on Tue, 29 May 2018 19:44:42 GMT]]>Thx but it's apparent you didn't understand what I was asking\suggesting...please re-read and ask me if you need clarification. Otherwise, I'm sure someone else will be able to address my questions...

]]>https://forum.netgate.com/post/768583https://forum.netgate.com/post/768583Tue, 29 May 2018 19:44:42 GMT<![CDATA[Reply to CIDR in suppress list not showing in Alerts pane on Tue, 29 May 2018 07:39:03 GMT]]>Nope, suppress the host entry then edit the suppress list after to changing it to the subnet/cidr.

#ET MALWARE User-Agent (Mozilla/4.0 (compatible)) - muso BBC iPlayer
suppress gen_id 1, sig_id 2008974, track by_dst, ip 23.192.162.0/24

]]>https://forum.netgate.com/post/768420https://forum.netgate.com/post/768420Tue, 29 May 2018 07:39:03 GMT