[Snort-users] No logging from localhost?

Erek Adams erek at ...577...
Fri May 3 10:30:05 EDT 2002


On Fri, 3 May 2002, Whaley, Mike wrote:

[...snip...]

> Say there is 10 events for the classification kicka$$-porn.  I go and view
> those events with the acid interface from a remote machine.  Then snort
> picks up on the word "porn" and logs another 20 or so events in the
> database.  Now, instead of having 10 events for porn I know have 30 events
> with a two-thirds of them originating from the sensor.
>
> Is there a way to tell snort NOT to log events that originate from my
> sensor?  Is this a good Idea or will I cause myself problems in the future?
> I imagine this is happening with other events too that I am viewing.  Is
> this correct?  Thank you very much for your help.

Well, two things leap to mind.  1)  Change EXTERNAL_NET from 'any' to
!$HOME_NET and 2) bind your ACID webserver to the loopback and use SSH to
tunnel back to your side.

Hope that helps!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net





More information about the Snort-users mailing list