L3retriver alerts

["Augustinho Catto" <Catto () atlas unisinos br>]

Dear gurus:

We have an A.D. Server running inside our enclave network (for 
corporate servers) and, of course our workstations, inside of our 
internal network send packets to this server and this event is 
logged as "bad event" "IDS311/PING-SCANNER-L3RETRIEVER" .
But this "ping" is necessary to our workstation, so to avoid this alert 
I created W2K_SERVER [10.20.200.73/32, 10.20.200.74/32] inside 
of our snort.conf.

After that I modified icmp.rules file: 
"alert icmp $EXTERNAL_NET -> $W2K_SERVER .... ".

In spite of this fact the snort is still given us this alert.

How could I avoid its?

TIA
Catto
 
Augustinho Valmor CATTO
CNE - Analista de Suporte 
UNISINOS - Universidade do Vale do Rio dos Sinos
Sao Leopoldo - RS - Brasil
Phone: +55 xx 51 590-8386
http://www.unisinos.br/institucional/estrutura/





-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users