[Snort-users] Help to configure SNORT

Lorenzo Rossi condor_rl at ...2470...
Tue Dec 23 13:26:02 EST 2003


Hi, I'm new to snort.

I have installed it and configured to work with MYSQL and AICD, all
seems work fine.
My problem is that I would like to tune snort to avoid false positive.

I decided to read the reports of ACID to see what type of alerts are
present.

Now I can see lots of lines like this:

------------------------------------------------------
#0-(1-8)

(spp_stream4) TCP CHECKSUM CHANGED ON RETRANSMISSION (possible
fragroute) detection

2003-12-09 00:10:58

192.168.1.3:32955
146.48.80.4:993
TCP   
---------------------------------------------------------------

#1-(1-9)

(spp_stream4) possible EVASIVE RST detection

2003-12-09 00:11:25

192.168.1.3:33587
146.48.80.4:995
TCP   
--------------------------------------------------------------

I would like to avoid this alerts because 146.48.80.4 is the e-mail
server of my ISP!

I can also see lots of lines of the same type but the destination
address are some Internet Servers like "www" and "ftp"


Could you help me to solve this problem?


Thanks

Lorenzo





More information about the Snort-users mailing list