Snort Suppression - ordering and tagging entries?
FlashPan last edited by
I've been looking around on the pfsense forums and snort and not really found my answers.
I am wondering if for optimisation purposes is it better to list supression entries in a particular order? eg in order of gen_id and sig_id? So my example below I would move the 2nd entry to the top of the list.
suppress gen_id 120, sig_id 3
suppress gen_id 119, sig_id 2
suppress gen_id 3, sig_id 19187, track by_src, ip 18.104.22.168
Additionally is it possibe to add a tag to the end of each entry?
suppress gen_id 3, sig_id 19187, track by_src, ip 22.214.171.124 : Opendns Server
Thank you in advance for any help/advice.
eri-- last edited by
It is not possible today but patches are accepted.