[Snort-users] Allowing windows updates to pass through snort

waldo kitty wkitty42 at ...14940...
Tue Feb 18 13:10:42 EST 2014

On 2/18/2014 11:30 AM, Doug Olitsky wrote:
> OK, I'm a beginner at this and after months of trying to read and teach
> myself I cry uncle...
> I have Snort running on a pfSense gateway I built a year ago. For the
> life of me I cannot figure out how to prevent windows updates from being
> blocked. My lame solution is to disable Snort for updates and then
> restart when done.

1. simply disable the specific rule(s) that are causing snort to alert on that 


set those hosts as allowed for those sigs by using the threshold.conf file.

NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

More information about the Snort-users mailing list