Re: Snort Network Suppression

Assuming you have correctly defined the variables in the /etc/snort.conf
file paying close attention to the $HOME_NET and $EXTERNAL_NET variables
you might want to consider a BPF filter on your input.


On Fri, 2007-12-14 at 13:09 -0500, Jonathan Askew JBASKEW wrote: 
> I am new to IDS and have just set up snort on a ubuntu host. It has worked
> well except for the fact that I am getting some false positivies from local
> traffic on the network. I have been trying to find the solution on snort's
> forums but the site seems to be going up and down randomly. I want to set a
> rule in order to suppress/ignore local network traffic for 192.168.1.0/24.
> I know this can be done in the /etc/threshold.conf file but have not been
> able to do so successfully. Can someone be so kind as to post their
> threshold.conf file or guide me through the process?
> 
> Thanks,
> Blake
> 
> 
> ------------------------------------------------------------------------
> Test Your IDS
> 
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it 
> with real-world attacks from CORE IMPACT.
> Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
> to learn more.
> ------------------------------------------------------------------------
> 


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------