Snort mailing list archives
PIM - Multicasts
From: "Walt Rich" <walt.rich () parago com>
Date: Tue, 23 Aug 2005 12:07:23 -0500
I've been fairly successful in tuning snort in our environment, and have reduced the number of false positives dramatically. I have a question though: How do I disable the PIM alerts generated by Snort for our internal network? I constantly receive BAD_TRAFFIC IP Proto 103 PIM alerts. We run multicasting on our internal network because we use Norton Ghost to setup workstations. The Ghostcasting feature requires the enabling of multicasting, and we don't need to see these alerts. Thanks! ________________________________ | Walt Rich | Sr. Network Engineer | Parago, Inc. | 972.538.7253 | walt.rich () parago com |
Current thread:
- PIM - Multicasts Walt Rich (Aug 23)
- Re: PIM - Multicasts Eric Maheo (Aug 23)