[Snort-users] ignore a single host

Keith Pachulski keithp at ...222...
Mon Nov 22 08:47:02 EST 2004

one of many ways..

pass udp any -> $HOME_NET 161 (msg:"SNMP request udp"; reference:bugtraq,4088; reference:bugtraq,4089; reference:bugtraq,4132; reference:cve,2002-0012; reference:cve,2002-0013; classtype:attempted-recon; sid:1417; rev:9;)

-----Original Message-----
From: isp [mailto:isp at ...12699...]
Sent: Sunday, November 21, 2004 4:44 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] ignore a single host

Can't quit figure out how to ignore a single computer.

I have a computer which continuously gets following alert.  It is because it
is making lots of SNMP requests which is what it is suppose to do.  How do I
get snort to ignore a single host like this or just ignore this particular

thanks terry

[**] [1:1417:9] SNMP request udp [**]
[Classification: Attempted Information Leak] [Priority: 2]
11/21-03:37:59.626234 ->
UDP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:118 DF
Len: 90

SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list