[Snort-users] Pass rule not passing preprocessors

Always Bishan bishan4u at ...1396...
Sun Apr 20 00:21:07 EDT 2003


Hi Snorters,

I wrote a pass rule which will pass anything coming
from one machine.
pass tcp 192.168.1.2 -> any any
pass icmp 192.168.1.2 -> any any
pass udp 192.168.1.2 -> any any

now I run nessus scanner from 192.168.1.2, after the
scan when I viewed the alerts from my ACID.
It still gave me alerts coming from preprocessors like
spp_stream4 and spp_bo. But the alerts in the rule
file didn't come up which use to come up when there
was no pass rule for 192.168.1.2.

Now by writing this pass rule I'm able to avoid any
alerts from my rules directory, but preprocessors are
still generating alerts. 

Is there anyway to avoid this?

Regards,
Bishan

*Note: I did use -o option at snort start up

=====
Celebrating Happiness
email: bishan at ...8634...
company: www.sumerusolutions.com

__________________________________________________
Yahoo! Plus
For a better Internet experience
http://www.yahoo.co.uk/btoffer




More information about the Snort-users mailing list