[Snort-users] No logging from localhost?
erek at ...577...
Fri May 3 10:30:05 EDT 2002
On Fri, 3 May 2002, Whaley, Mike wrote:
> Say there is 10 events for the classification kicka$$-porn. I go and view
> those events with the acid interface from a remote machine. Then snort
> picks up on the word "porn" and logs another 20 or so events in the
> database. Now, instead of having 10 events for porn I know have 30 events
> with a two-thirds of them originating from the sensor.
> Is there a way to tell snort NOT to log events that originate from my
> sensor? Is this a good Idea or will I cause myself problems in the future?
> I imagine this is happening with other events too that I am viewing. Is
> this correct? Thank you very much for your help.
Well, two things leap to mind. 1) Change EXTERNAL_NET from 'any' to
!$HOME_NET and 2) bind your ACID webserver to the loopback and use SSH to
tunnel back to your side.
Hope that helps!
More information about the Snort-users