[Snort-users] PP not ignoring ICMP

Agus agus.262 at ...11827...
Fri Apr 8 17:53:29 EDT 2011


Hi guys,

I cant make PP ignore icmp rules. Im running PP-060. snort 2.9.0.3

I have this line in my pulledpork.conf
ignore=deleted.rules,experimental.rules,local.rules,icmp.rules,emerging-drop-BLOCK,emerging-compromised-BLOCK,emerging-dshield-BLOCK,emerging-botcc-BLOCK,emerging-rbn-BLOCK,emerging-tor-BLOCK

I have also tried with icmp only and same issue. still getting the
icmp alerts and seeing them in the snort.rules.

pulledpork.pl -n -c etc/pulledpork.conf -T -v
shows:
	ignore = deleted.rules,experimental.rules,local.rules,icmp.rules,emerging-drop-BLOCK,emerging-compromised-BLOCK,emerging-dshield-BLOCK,emerging-botcc-BLOCK,emerging-rbn-BLOCK,emerging-tor-BLOCK

then it gives me an error, probably something with the perl module.
Can't locate object method "show_progress" via package
"LWP::UserAgent" at ./pulledpork.pl line 1651.

Still ICMP rules in snort.rules

Any thoughts?

Cheers




More information about the Snort-users mailing list