[Snort-users] Can't suppress Tagged Packet

Dirk Geschke dirk at ...10648...
Fri May 26 04:39:02 EDT 2006


Hi Rob,

> I'm using Net BSD 3 current and Snort 2.4.4.
> 
> I can't suppress the 'Tagged Packet' alert which is producing thousands of 
> false positives and swamping my database.
> 
> All other suppression and thresholding works fine.
> 
> I have the following in threshold.conf
> 
> # Suppress Tagged Packet
> suppress gen_id 2, sig_id 1, track by_src, ip x.x.0.0/16
> suppress gen_id 2, sig_id 1, track by_dst, ip x.x.0.0/16
> 
> gen-msg.map has the following:
> 
> 2 || 1 || tag: Tagged Packet

is it possible that you use the unified output plugin?

In this case all rebuild packets from stream4 which raise an alert
are stored as the original individual packets. The first is associated
with the alert message and all further parts are labeled as "Tagged
Packet". 

So in this case it will not help to suppress it this way. I fear
you have to tune your rules to reduce the number of alerts. (Or
you can use another output method, AFAIK only the unified output
plugin decomposes the rebuild packet with "Tagged Packets".)

Best regards

Dirk




More information about the Snort-users mailing list