[Snort-users] Exclude IPs from snort rules - snort IPS

Joel Esler (jesler) jesler at ...589...
Wed May 31 23:39:13 EDT 2017


Pass rule is correct.  Wherever you read the order thing is wrong.  There are several ways to ensure order, all are in the manual.  

Sent from my iPad

> On May 31, 2017, at 10:37 PM, Forensix Land <forensixland at ...11827...> wrote:
> 
> Hi,
> We have snort 2.9.9.0 running as IPS. I need recommendation on how to exclude some IPs from a drop rule.
> According to the document, suppressing track by source or destination ip only does not log the alerts but the rule is still applied. when running as IPS, this means it still drops the traffic without logging.
> 
> I am considering using "pass" rule, but I read somewhere there is no way to guarantee the rule order so the "pass" rule always wins over the "drop" or "alert" rule. 
> 
> Any other suggestions than modifying the rule?
> 
> 
> 
> Thanks in advance!
> 
> FL
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!




More information about the Snort-users mailing list