Re: Strange Alerts

Hi.

There are two ways to ignore those alerts (if you really need that).

1. By suppressing the event from the rule "116:444 (ipv4) IPv4 option set":

suppress =
{
    { gid = 116, sid = 444, track = 'by_src', ip = '192.168.1.19' },
    { gid = 116, sid = 444, track = 'by_src', ip = '192.168.1.25' }
}

suppress =
{
    { gid = 116, sid = 444, track = 'by_dst', ip = ' 224.0.0.22' }
}

suppress =
{
    { gid = 116, sid = 444 }
}

2. By disabling the rule itself:

ips.states = [[ alert ( gid:116; sid:444; enable:no; ) ]]



Have a nice day ahead!

On 1 Jun 2023, at 01:59, Jim Campbell via Snort-users <[email protected]<mailto:[email protected]>> wrote:

I appreciate the prompt responses to my questions. I do have the ability to capture
the packets in question but before I do that I have another question. Are these packets
something to be concerned about? If so, I will get WireShark involved. If not, how
do I tell Snort to ignore them?

Thank you,

Jim Campbell

On 5/31/2023 4:47 PM, Al Lewis (allewi) wrote:
Look like IGMP traffic

https://www.iana.org/assignments/multicast-addresses/multicast-addresses.xhtml


Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
SOURCEfire, Inc. now part of Cisco
Email: [email protected]<mailto:[email protected]>
________________________________
From: Al Lewis (allewi) <[email protected]><mailto:[email protected]>
Sent: Wednesday, May 31, 2023 4:45 PM
To: Snort-users <[email protected]><mailto:[email protected]>; Jim Campbell <[email protected]><mailto:[email protected]>
Subject: Re: [Snort-users] Strange Alerts

Have you been able to look at the packets? Which options are set in the header?

Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
SOURCEfire, Inc. now part of Cisco
Email: [email protected]<mailto:[email protected]>
________________________________


_______________________________________________
Snort-users mailing list
[email protected]<mailto:[email protected]>
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

To unsubscribe, send an email to:
[email protected]<mailto:[email protected]>

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette