[Snort-users] alert suppression

Jefferson, Shawn Shawn.Jefferson at ...14448...
Wed May 6 16:28:50 EDT 2009


 1.  I'm not sure.  I didn't even know that this alert could be triggered by a rule instead of the pre-processor.  How would I figure out which rule(s) may be triggering the taq: tagged packet alert?  What's the purpose of this alert?

 1.  I'll take another look at the readme for the dcerpc2 preprocessor.  Maybe I can set some alert suppression for these in the threshold.conf file instead...

Thanks for your help,

From: Joel Esler [mailto:jesler at ...1935...]
Sent: May 05, 2009 4:39 PM
To: Jefferson, Shawn
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] alert suppression

What alert is generating the tag alerts?  Is it a rule, or is it the stream preprocessor?  (grep your rules files for the word "Tag".  I think there is only 1 rule in the VRT ruleset with tag turned on by default.

As for the dcerpc2 preprocessor, take a look at the readme.  It has an "events none" configuration option for your snort.conf.

On Tue, May 5, 2009 at 6:25 PM, Jefferson, Shawn <Shawn.Jefferson at ...14579.....<mailto:Shawn.Jefferson at ...14448...>> wrote:

I want to suppress some alerts I've been getting, specifically the tag: tagged packet.  I've tried putting "suppress gen_id 2, sig_id 1" in the threshold.conf file, but this doesn't seem to be working.  Is there a better way to suppress this alert?  Especially if there is a method that is better performance-wise.  I've looked around in the documentation and didn't see anything specific to the tag: tagged packet alert.

Also, the new dcerpc2 preprocesser is pretty noisy in my environment, creating quite a few alerts each day.  Can anyone share any tuning advice for this?


The NEW KODAK i700 Series Scanners deliver under ANY circumstances! Your
production scanning environment may not be a perfect world - but thanks to
Kodak, there's a perfect scanner to get the job done! With the NEW KODAK i700
Series Scanner you'll get full speed at 300 dpi even with all image
processing features enabled. http://p.sf.net/sfu/kodak-com
Snort-users mailing list
Snort-users at lists.sourceforge.net<mailto:Snort-users at lists.sourceforge.net>
Go to this URL to change user options or unsubscribe:
Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-users%0d%0aSnort-users> list archive:

joel esler | Sourcefire | gtalk: jesler at ...1935...<mailto:jesler at ...1935...> | 302-223-5974 | http://twitter.com/joelesler
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20090506/4b7aabf3/attachment.html>

More information about the Snort-users mailing list