[Snort-users] Disable by name in pulled pork
fivetenets at ...14399...
Thu Jun 19 14:47:28 EDT 2014
I saw this on a forum page. Is this possible to do in pulled pork?
I want to disable some rules but don't know exactly how or the sid ID. I like this way if it works.
I just don't know where or how these disable rules were entered.
OK. Deleted the entries on...
Applications > IDS Rules >Disabled Downloaded Rules
# Disable "stream5: TCP Small Segment Threshold Exceeded"
# Disable "ssh: Protocol mismatch"
# Disable "http_inspect: LONG HEADER"
# Disable "sensitive_data: sensitive data global threshold exceeded"
# Disable "stream5: Reset outside window"
# Disable "http_inspect: MESSAGE WITH INVALID CONTENT-LENGTH OR CHUNK SIZE"
More information about the Snort-users