[Snort-users] suppressing all signatures from a particular generator

Victor Roemer vroemer at ...1935...
Wed Aug 29 16:05:41 EDT 2012


This is actually a shortcoming of the event filters in Snort currently. The
problem is that Snort doesn't allow for overlapping global event filters
(those with sig_id: 0)

So the following configuration would not work

threshold gen_id 0, sig_id 0, type limit, track by_src, count 1, seconds 60
suppress gen_id 120, sig_id 0

We've identified this as being a problem, aside from also being obnoxious,
and plan on fixing it in a future release.

- Victor

On Wed, Aug 29, 2012 at 4:57 AM, James Davis <james.davis at ...15783...> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> On 24/08/2012 15:30, Victor Roemer wrote:
> > Could you provide your entire threshold configuration?
>
> Apologies for the slow response, our office has been closed. At
> present and without comments the configuration is:
>
> threshold gen_id 0, sig_id 0, type limit, track by_src, count 1,
> seconds 60
>
> suppress gen_id 129, sig_id 12
> suppress gen_id 129, sig_id 15
> suppress gen_id 129, sig_id 4
> suppress gen_id 120, sig_id 6
> suppress gen_id 120, sig_id 7
> suppress gen_id 120, sig_id 8
> suppress gen_id 141, sig_id 1
> suppress gen_id 141, sig_id 2
> suppress gen_id 119, sig_id 19
> suppress gen_id 119, sig_id 15
> suppress gen_id 119, sig_id 14
> suppress gen_id 120, sig_id 3
> suppress gen_id 120, sig_id 10
> suppress gen_id 128, sig_id 4
> suppress gen_id 137, sig_id 1
> suppress gen_id   1, sig_id 2006380
>
> Regards,
>
> James
>
> - --
> James Davis                0300 999 2340 (+44 1235 822340)
> Senior CSIRT Member
> Lumen House, Library Avenue, Didcot, Oxfordshire, OX11 0SG
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (Darwin)
> Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
>
> iF4EAREIAAYFAlA92YIACgkQjsS2Y6D6yLywrgEAjfnxcdiAclHNHc1bYqorUrrv
> +BXAOpuASmQSNrZ/1OsA/2cboKcViXNtV7PBrC9KPGc2Pj0447WHYFlHkqKxTYf+
> =50PG
> -----END PGP SIGNATURE-----
>
> Janet is a trading name of The JNT Association, a company limited
> by guarantee which is registered in England under No. 2881024
> and whose Registered Office is at Lumen House, Library Avenue,
> Harwell Oxford, Didcot, Oxfordshire. OX11 0SG
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20120829/5e49f157/attachment.html>


More information about the Snort-users mailing list