[Snort-users] Ignore ICMP ping

Joe McAlerney joey at ...47...
Fri May 31 14:27:03 EDT 2002


Just FYI, aside from pass rules you can use SnortSnarf's -Xsid=<sid>
option to exclude any alerts by their sid number.

-Joe M.

-- 
Joe McAlerney
Silicon Defense: IDS Solutions

Math wrote:
> 
> Hello, i just wanna know if there is anyway to block ICMP PING from a
> computer. I find how to ignore some tcp/udp ping by the preprocessor
> command in Snort.conf, but can i just but another line to disable some
> server ICMP PING activity to be put in my alert log?
> A little help would be appreciate here if anybody got answer ... I use
> SnortSnarf and i dont wanna see those ping in my stats, so must block in
> snort...
> 
> thx math
> Comp. Ing. ULaval
> 
> _______________________________________________________________
> 
> Don't miss the 2002 Sprint PCS Application Developer's Conference
> August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users




More information about the Snort-users mailing list