[Snort-users] re: Pass Rule question

Kenneth G. Arnold bkarnold at ...8060...
Thu Jun 12 11:58:06 EDT 2003


Did you add the file pass.rules to the snort.conf file with all the other 
rules files?

e.g.
include $RULE_PATH/pass.rules

I would suggest that you create a variable in snort.conf. e.g. SNMP_DEST

var SNMP_DEST [y.y.y.y/32,z.z.z.z/32]

Then add a line similar to the following to pass.rules:

pass udp x.x.x.x/32 any -> $SNMP_DEST 161

If you want to add any additional destinations in the future, you will only 
need to add more IP addresses to the variable.

Ken
At 09:32 AM 6/11/2003 -0400, lindsay.hunt at ...9446... wrote:
>Hello,
>
>I have a question regarding the use of pass rules. I am running snort with
>the "-o" option and want to ignore specific snmp traffic; specifically,
>snmp requests from a particular ip address destined for 2 separate
>addresses.
>
>I created a file called pass.rules and placed it in the rules directory. It
>has the following syntax:
>
>      pass udp x.x.x.x any -> udp [y.y.y.y , z.z.z.z ] 161
>
>
>x.x.x.x corresponds to the source address and y and z to the destination
>addresses.
>
>Is the syntax correct? The traffic that I want to ignore is still showing
>up as alerts.  Thanks in advance for any help.
>
>
>kind regards,
>
>Lindsay Hunt
>Network Engineer
>Alstom Power
>phone 804-763-7239
>mobile 804-334-1682
>fax 804-763-7107
>
>
>CONFIDENTIALITY : This e-mail and any attachments are confidential and may
>be privileged. If you are not a named recipient, please notify the sender
>immediately and do not disclose the contents to another person, use it for
>any purpose or store or copy the information in any medium.
>
>
>
>-------------------------------------------------------
>This SF.NET email is sponsored by: eBay
>Great deals on office technology -- on eBay now! Click here:
>http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users


Brother Kenneth Arnold
System Administrator
Information Technology Services
Christian Brothers University
(901) 321-4333





More information about the Snort-users mailing list