[Snort-users] Excluding a single host from a rule

Roman Daszczyszak romandas at ...11827...
Thu Nov 15 06:09:09 EST 2007


Hi all,

I'm relatively new to using Snort, yet I've read through the rules
section in the manual and tried searching the Sourcefire forums and
can't seem to find an answer to this.

How can I exclude a single host on my network from an alert rule?

Specifically, I have a fileserver that hosts Windows shares for our
users' home directory and profiles.  The users connect from all across
our enterprise and when they do, Windows XP seems to handle the
transaction first by pinging the fileserver, then establishing the
connection via TCP/NetBIOS.  However, with the quantity of users, each
of those ICMP pings prior to the real connection are collectively
causing the ICMP NMAP rule to fire.

I would like to exclude the fileserver from alerting when the NMAP
rule fires, yet keep the rule active for the rest of the network.  How
can I do this?

Thanks,
Roman




More information about the Snort-users mailing list