[Snort-users] icmp i want to ignore

Don Don at ...5881...
Wed Jun 5 12:27:06 EDT 2002


the following rule in icmp.rules
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP L3retriever Ping";
content: "ABCDEFGHIJKLMNOPQRSTUVWABCDEFGHI"; itype: 8; icode: 0; depth: 32;
reference:arachnids,311; classtype:attempted-recon; sid:466; rev:1;)
triggers an alert for me i wish to ignore, from 1 source IP address, I know
what causes it on this source, so i wish to ignore this source only, what
would be the best way for this?
any suggestions

Don





More information about the Snort-users mailing list