[Snort-users] PIM - Multicasts

Walt Rich walt.rich at ...12648...
Tue Aug 23 10:09:38 EDT 2005

I've been fairly successful in tuning snort in our environment, and have
reduced the number of false positives dramatically.   I have a question
though: How do I disable the PIM alerts generated by Snort for our
internal network?  I constantly receive 
BAD_TRAFFIC IP Proto 103 PIM alerts.  We run multicasting on our
internal network because we use Norton Ghost to setup workstations.  The
Ghostcasting feature requires the enabling of multicasting, and we don't
need to see these alerts.

| Walt Rich | Sr. Network Engineer | Parago, Inc. | 972.538.7253 | 
walt.rich at ...12648... |
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050823/e19af20f/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: parago_logo_for_email.gif
Type: image/gif
Size: 2113 bytes
Desc: parago_logo_for_email.gif
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050823/e19af20f/attachment.gif>

More information about the Snort-users mailing list