[Snort-users] Allowing windows updates to pass through snort
wkitty42 at ...14940...
Tue Feb 18 13:10:42 EST 2014
On 2/18/2014 11:30 AM, Doug Olitsky wrote:
> OK, I'm a beginner at this and after months of trying to read and teach
> myself I cry uncle...
> I have Snort running on a pfSense gateway I built a year ago. For the
> life of me I cannot figure out how to prevent windows updates from being
> blocked. My lame solution is to disable Snort for updates and then
> restart when done.
1. simply disable the specific rule(s) that are causing snort to alert on that
set those hosts as allowed for those sigs by using the threshold.conf file.
NOTE: No off-list assistance is given without prior approval.
Please keep mailing list traffic on the list unless
private contact is specifically requested and granted.
More information about the Snort-users