[Snort-users] Commented rule triggering alerts

Lay, James james.lay at ...15009...
Wed Apr 10 16:44:59 EDT 2013


Also in community rules:

 

grep -i ping * | grep -i icmp | grep 381

community.rules:# alert icmp $EXTERNAL_NET any -> $HOME_NET any
(msg:"PROTOCOL-ICMP PING Oracle Solaris"; dsize:8; itype:8;
metadata:ruleset community; classtype:misc-activity; sid:381; rev:11;)

 

VRT-protocol-icmp.rules:# alert icmp $EXTERNAL_NET any -> $HOME_NET any
(msg:"PROTOCOL-ICMP PING Oracle Solaris"; dsize:8; itype:8;
metadata:ruleset community; classtype:misc-activity; sid:381; rev:11;)

 

James

From: Joao Daniel Neves [mailto:joaodanielnevesss at ...125...] 
Sent: Wednesday, April 10, 2013 1:54 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Commented rule triggering alerts

 

Hi,

I have a lot of ICMP/Ping alerts. So I decided to remove the rule that
was triggering those alerts. The  sid of the rule is 381.
I  did the following:

cd /etc/snort/rules

grep -wril 'sid:381' ./*
./icmp-info.rules

vim icmp-info.rules

I found the line and then commented it by placing an "#" in the begging
of the line. I stopped Snort and then stated it again.

And I still get alert for that SID. What can I do to solve it ? 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130410/0058c792/attachment.html>


More information about the Snort-users mailing list