[Snort-users] Disabling Rules via disablesid.conf

Vona, Steven A CIV NSWCCD Philadelphia, 10411 steven.vona at ...7622...
Fri Feb 6 09:16:22 EST 2015

Thanks for the heads up.  I followed your troubleshooting steps and I found the offending alert in bad_traffic.rules file.  I deleted the line and it looks like they are disabled now.

Thanks again.

-----Original Message-----
From: Y M [mailto:snort at ...15979...] 
Sent: Friday, February 06, 2015 2:16 AM
To: Vona, Steven A CIV NSWCCD Philadelphia, 10411
Cc: snort-users
Subject: RE: [Snort-users] Disabling Rules via disablesid.conf

Comments inline.

From: steven.vona at ...7622...
To: snort-users at lists.sourceforge.net
Date: Thu, 5 Feb 2015 20:47:40 +0000
Subject: [Snort-users] Disabling Rules via disablesid.conf

I have Snort running on a few sensors around our network.  We have subscriptions for the rules and we use pulledpork to download the rules daily.
I am not attempting to turn the rules a little bit to disable some items that we do not need to see.  I put these in disablesid.conf file and when I run pulled pork I see:
Processing /etc/snort/disablesid.conf....
	Disabled 3:21355
	Disabled 3:19187
	Modified 2 rules
So it looks like it is disabling the rule, however I am still receiving alerts for the rule in my database.
Any ideas? 
## Some ideas to troubleshoot: 1) verify that the same sids are not included in the enablesid.conf (lame but why not). 2) Has the order in which PulledPork processes rules been changed?. 3) if you grep for the sids from the snort.rules (given you reconcile rules vi PulledPork), do they exist? 4) Are these two rules included in another .rules file (local.rules or so)?

Additional info:
   ,,_     -*> Snort! <*-
  o"  )~   Version GRE (Build 77) 
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
           Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using libpcap version 1.3.0
           Using PCRE version: 7.8 2008-09-05
           Using ZLIB version: 1.2.3

------------------------------------------------------------------------------ Dive into the World of Parallel Programming. The Go Parallel Website, sponsored by Intel and developed in partnership with Slashdot Media, is your hub for all things parallel software development, from weekly thought leadership blogs to news, videos, case studies, tutorials and more. Take a look and join the conversation now. http://goparallel.sourceforge.net/
_______________________________________________ Snort-users mailing list Snort-users at lists.sourceforge.net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5607 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150206/4cedf9f6/attachment.bin>

More information about the Snort-users mailing list