Re: [RGSPAM] Re: [RGSPAM] exclude ip

[Jason Brvenik <jasonb () sourcefire com>]

Create a pass rule

http://www.snort.org/docs/snort_htmanuals/htmanual_260/node17.html#SECTION00421000000000000000

use a bpf

http://www.snort.org/docs/snort_htmanuals/htmanual_260/node10.html

look for bpf_file

Al McGale wrote:
> I've looked over the user guide, but I'm obviously not looking in the
> right spot.  In my environment there are some sensors that will see
> traffic from multiple scanning stations.  I've been adding the scanners
> to the threshold.conf one by one for each rule they hit, but I would
> much prefer to eliminate the scanner's IP addresses completely for all
> rules.
>  
> Can someone point me in the right direction on this? 
>  
> On 7/7/06, *Lee Clemens* <snort () leeclemens net
> <mailto:snort () leeclemens net>> wrote:
>
>     If you want to exclude it for one rule (or a few), just put it in
>     threshold.conf. Check out the user's guide for syntax...
>
>     -----Original Message-----
>     From: snort-users-bounces () lists sourceforge net
>     <mailto:snort-users-bounces () lists sourceforge net>
>     [mailto:snort-users-bounces () lists sourceforge net
>     <mailto:snort-users-bounces () lists sourceforge net>] On Behalf Of
>     Joel Esler
>     Sent: Friday, July 07, 2006 8:05 AM
>     To: fname lname
>     Cc: snort-users () lists sourceforge net
>     <mailto:snort-users () lists sourceforge net>
>     Subject: Re: [Snort-users] [RGSPAM] exclude ip
>
>     Can you place it in 'EXTERNAL_NET'?
>
>     J
>
>     On Wed, Jul 05, 2006 at 05:08:45PM -0400, fname lname sent me:
>     > If I wanted to exclude an ip from the ids how will i go about
>     doing that.
>     > Ex is I wanted to exclude 1.2.3.4 <http://1.2.3.4> from an smtp
>     rule how can i make that
>     > happen?
>
>     > Using Tomcat but need to do more? Need to support web services,
>     security?
>     > Get stuff done quickly with pre-integrated technology to make your
>     job
>     easier
>     > Download IBM WebSphere Application Server v.1.0.1 based on Apache
>     Geronimo
>     >
>     http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
>     <http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642>
>
>     > _______________________________________________
>     > Snort-users mailing list
>     > Snort-users () lists sourceforge net
>     <mailto:Snort-users () lists sourceforge net>
>     > Go to this URL to change user options or unsubscribe:
>     > https://lists.sourceforge.net/lists/listinfo/snort-users
>     > Snort-users list archive:
>     > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>     +---------------------------------------------------------------------+
>     Joel Esler          Senior Security Consultant         1-706-627-2101
>     Sourcefire    Security for the /Real/ World -- http://www.sourcefire.com
>     Snort - Open Source Network IPS/IDS -- http://www.snort.org
>     GPG Key http://demo.sourcefire.com/jesler.pgp.key
>     +---------------------------------------------------------------------+
>
>     Using Tomcat but need to do more? Need to support web services,
>     security?
>     Get stuff done quickly with pre-integrated technology to make your job
>     easier
>     Download IBM WebSphere Application Server v.1.0.1 based on Apache
>     Geronimo
>     http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
>     <http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642>
>     _______________________________________________
>     Snort-users mailing list
>     Snort-users () lists sourceforge net
>     <mailto:Snort-users () lists sourceforge net>
>     Go to this URL to change user options or unsubscribe:
>     https://lists.sourceforge.net/lists/listinfo/snort-users
>     Snort-users list archive:
>     http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
>     Using Tomcat but need to do more? Need to support web services,
>     security?
>     Get stuff done quickly with pre-integrated technology to make your
>     job easier
>     Download IBM WebSphere Application Server v.1.0.1 based on Apache
>     Geronimo
>     http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
>     <http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642>
>     _______________________________________________
>     Snort-users mailing list
>     Snort-users () lists sourceforge net
>     <mailto:Snort-users () lists sourceforge net>
>     Go to this URL to change user options or unsubscribe:
>     https://lists.sourceforge.net/lists/listinfo/snort-users
>     Snort-users list archive:
>     http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
> ------------------------------------------------------------------------
>
>
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users