[Snort-users] Same source/dest

james hackerwacker at ...3784...
Tue Apr 1 20:45:29 EST 2003


: I have disable 'bad traffic same src/dst' in bad-traffic rules but I 
: just want to check with you my thoughts on that.


If it is just one src/dst pair that is alerting on 
legit traffic, just modify the rule to exclude
these IP's. In this case maybe set up a variable
that excludes the IP's; or perhaps use a "!" ie,

alert ip any any -> !10.1.2.3/32 25

j 




More information about the Snort-users mailing list