[Snort-users] Disable by name in pulled pork

Nicholas Horton fivetenets at ...14399...
Thu Jun 19 14:47:28 EDT 2014


I saw this on a forum page. Is this possible to do in pulled pork?

I want to disable some rules but don't know exactly how or the sid ID. I like this way if it works. 

I just don't know where or how these disable rules were entered.

Thanks!

OK. Deleted the entries on...
Applications > IDS Rules >Disabled Downloaded Rules
# Disable "stream5: TCP Small Segment Threshold Exceeded"
# Disable "ssh: Protocol mismatch"
# Disable "http_inspect: LONG HEADER"
# Disable "sensitive_data: sensitive data global threshold exceeded"
# Disable "stream5: Reset outside window"
# Disable "http_inspect: MESSAGE WITH INVALID CONTENT-LENGTH OR CHUNK SIZE"

Nick




More information about the Snort-users mailing list