Re: Config Issue - Suppress Module

Hi Fell,

Initially suppress was not created for “suppress” alerts by IP, but for GID:SID suppress.

To disable detection(suppress) for a specific IP you can use next configurations.

  1.  Add next lines to your main config file:
        binder =
   {
        { when = { src_nets = "W.X.Y.Z " }, use = { ips_policy = "ips.lua" } },
        { when = { dst_nets = "W.X.Y.Z " }, use = { ips_policy = "ips.lua" } },
   }


  1.  Create new file with name ips.lua(just according to filename specified in binder) with next line:

ips = { }

So here we create an empty policy and switch to it when specific IP appears.


Please let us know if you have any other questions about Snort3 configuration.

Regards,
Anna
From: Snort-users <[email protected]> on behalf of Anna Norokh -X (anorokh - SOFTSERVE INC at Cisco) via Snort-users <[email protected]>
Date: Monday, 20 November 2023 at 16:15
To: fellsin <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: [Snort-users] Config Issue - Suppress Module

Hello,

After deeper investigation we found out that it’s a bug, so please ignore my previous mail.

Thank you for reporting this issue, Snort3 team will take a look and resolve this.

For now your config could be fixed only defining sid:gid of some rule for each line:
suppress =

{

    { gid = X, sid = X, track = 'by_src', ip = 'W.X.Y.Z' },

    { gid = X, sid = X,  track = 'by_dst', ip = 'W.X.Y.Z' },

}
P.S. due to the bug both sid and gid can not be assigned as 0 currently

Regards,
Anna

From: Anna Norokh -X (anorokh - SOFTSERVE INC at Cisco) <[email protected]>
Date: Wednesday, 15 November 2023 at 18:09
To: fellsin <[email protected]>
Subject: Re: [Snort-users] Config Issue - Suppress Module
Hello Fell,


The problem is that suppress can only track 1 option per config.

enum suppress[].track: suppress only matching source or destination addresses { 'by_src' | 'by_dst' }

So you need to select what direction you want to suppress.


Config ex.  https://github.com/snort3/snort3_demo/blob/master/tests/framework/suppress/snort.lua



Hope it will help!




Regards,
Anna

From: Snort-users <[email protected]> on behalf of fellsin via Snort-users <[email protected]>
Date: Wednesday, 15 November 2023 at 16:15
To: [email protected] <[email protected]>
Subject: [Snort-users] Config Issue - Suppress Module

Hello all,



Hope you're going all good.



As a fresh snort user, I am facing issues to set up suppress module trying to suppress a specific IP.




cat /usr/local/etc/snort/snort.lua
[...]

suppress =

{

    { track = 'by_src', ip = 'W.X.Y.Z' },

    { track = 'by_dst', ip = 'W.X.Y.Z' },

}



returns this



ERROR: /usr/local/etc/snort/snort.lua: threshold object cannot be created from the given parameters

ERROR: /usr/local/etc/snort/snort.lua: can't close suppress



Snort is happy with a single line...



I am running Snort3 (3.1.73.0) under Ubuntu 22.04.



Can anyone help me ?



Thanks,

All the best.
Fell

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette