Create a pass rule
http://www.snort.org/docs/snort_htmanuals/htmanual_260/node17.html#SECTION00421000000000000000
use a bpf
http://www.snort.org/docs/snort_htmanuals/htmanual_260/node10.html
look for bpf_file
Al McGale wrote:
I've looked over the user guide, but I'm obviously not looking in the
right spot. In my environment there are some sensors that will see
traffic from multiple scanning stations. I've been adding the scanners
to the threshold.conf one by one for each rule they hit, but I would
much prefer to eliminate the scanner's IP addresses completely for all
rules.
Can someone point me in the right direction on this?
On 7/7/06, *Lee Clemens* <snort@leeclemens.net
<mailto:snort@leeclemens.net>> wrote:
If you want to exclude it for one rule (or a few), just put it in
threshold.conf. Check out the user's guide for syntax...
-----Original Message-----
From: snort-users-bounces@lists.sourceforge.net
<mailto:snort-users-bounces@lists.sourceforge.net>
[mailto:snort-users-bounces@lists.sourceforge.net
<mailto:snort-users-bounces@lists.sourceforge.net>] On Behalf Of
Joel Esler
Sent: Friday, July 07, 2006 8:05 AM
To: fname lname
Cc: snort-users@lists.sourceforge.net
<mailto:snort-users@lists.sourceforge.net>
Subject: Re: [Snort-users] [RGSPAM] exclude ip
Can you place it in 'EXTERNAL_NET'?
J
On Wed, Jul 05, 2006 at 05:08:45PM -0400, fname lname sent me:
> If I wanted to exclude an ip from the ids how will i go about
doing that.
> Ex is I wanted to exclude 1.2.3.4 <http://1.2.3.4> from an smtp
rule how can i make that
> happen?
> Using Tomcat but need to do more? Need to support web services,
security?
> Get stuff done quickly with pre-integrated technology to make your
job
easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache
Geronimo
>
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
<http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642>
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
<mailto:Snort-users@lists.sourceforge.net>
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
+---------------------------------------------------------------------+
Joel Esler Senior Security Consultant 1-706-627-2101
Sourcefire Security for the /Real/ World -- http://www.sourcefire.com
Snort - Open Source Network IPS/IDS -- http://www.snort.org
GPG Key http://demo.sourcefire.com/jesler.pgp.key
+---------------------------------------------------------------------+
Using Tomcat but need to do more? Need to support web services,
security?
Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache
Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
<http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642>
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
<mailto:Snort-users@lists.sourceforge.net>
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
Using Tomcat but need to do more? Need to support web services,
security?
Get stuff done quickly with pre-integrated technology to make your
job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache
Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
<http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642>
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
<mailto:Snort-users@lists.sourceforge.net>
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
