Snort mailing list archives
Excluding a single host from a rule
From: "Roman Daszczyszak" <romandas () gmail com>
Date: Thu, 15 Nov 2007 12:09:09 +0100
Hi all, I'm relatively new to using Snort, yet I've read through the rules section in the manual and tried searching the Sourcefire forums and can't seem to find an answer to this. How can I exclude a single host on my network from an alert rule? Specifically, I have a fileserver that hosts Windows shares for our users' home directory and profiles. The users connect from all across our enterprise and when they do, Windows XP seems to handle the transaction first by pinging the fileserver, then establishing the connection via TCP/NetBIOS. However, with the quantity of users, each of those ICMP pings prior to the real connection are collectively causing the ICMP NMAP rule to fire. I would like to exclude the fileserver from alerting when the NMAP rule fires, yet keep the rule active for the rest of the network. How can I do this? Thanks, Roman ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Excluding a single host from a rule Roman Daszczyszak (Nov 15)
- Re: Excluding a single host from a rule Jeremy (Nov 15)