Re: how do i disable the specific snort rule called "TCP session without 3-way handshake [**] [Classification: Potentially Bad Traffic]"

Hi winxlinx,

in order to get rid of these alerts, you can use two ways:
1) if you think that this (lack of 3-way handshake) is normal for your traffic, you can use the stream_tcp.require_3whs parameter by setting it to -1. This will cause snort to process such sessions as a midstream, so doing full processing on them.
2) If you just don't want to see such alerts, you can use event filters or disable this rule using ips.states. Example:
ips.states =
[[
    alert ( gid:129; sid:20; enable:no; )
]]

From my point of view, using stream_tcp.require_3whs here would be more correct.

Thanks,
Vitalii!

From: Snort-users <[email protected]> on behalf of Winx Linx via Snort-users <[email protected]>
Date: Monday, 28 August 2023, 16:35
To: [email protected] <[email protected]>
Subject: Re: [Snort-users] how do i disable the specific snort rule called "TCP session without 3-way handshake [**] [Classification: Potentially Bad Traffic]"
Hi Team,

how do i disable the specific snort rule called "TCP session without 3-way handshake [**] [Classification: Potentially Bad Traffic]"

--

Regards

winxlinx

On Fri, Aug 25, 2023 at 11:40 PM Winx Linx <[email protected]<mailto:[email protected]>> wrote:
Hi Team,

how do i disable the specific snort rule called "TCP session without 3-way handshake [**] [Classification: Potentially Bad Traffic]"

--

Regards

winxlinx

On Fri, Aug 25, 2023 at 11:34 PM Winx Linx <[email protected]<mailto:[email protected]>> wrote:

Hi Team,

how do i disable the specific snort rule called "TCP session without 3-way handshake [**] [Classification: Potentially Bad Traffic]"

--

Regards

winxlinx


--

Regards

winxlinx


--

Regards

winxlinx

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette