<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">


<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
 /* Font Definitions */
 @font-face
        {font-family:veranda;
        panose-1:0 0 0 0 0 0 0 0 0 0;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        text-align:right;
        direction:rtl;
        unicode-bidi:embed;
        font-size:12.0pt;
        font-family:"Times New Roman";}
a:link, span.MsoHyperlink
        {color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {color:purple;
        text-decoration:underline;}
span.EmailStyle17
        {mso-style-type:personal-compose;
        font-family:Arial;
        color:windowtext;}
@page Section1
        {size:595.3pt 841.9pt;
        margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
        {page:Section1;}
-->
</style>

</head>

<body lang=EN-US link=blue vlink=purple>

<div class=Section1 dir=RTL>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>Hi,<o:p></o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>In
the process of tuning snort I want to disable all the Icmp alerts.<o:p></o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>In
acid I see many alerts like this:<o:p></o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> 
[<a href="http://www.snort.org/snort-db/sid.html?sid=485"
target="_ACID_ALERT_DESC"><font size=3 face="Times New Roman"><span
style='font-size:12.0pt;font-family:"Times New Roman"'>snort</span></font></a>]
ICMP Destination Unreachable Communication Administratively Prohibited
  <o:p></o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>I
entered to /etc/snort/rules/bad-traffic.rules but didn't saw nothing
regarding ICMP !!!<o:p></o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>Also,
in acid the link to snort that shows the rule's detail which is:<o:p></o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 color=black face=veranda><span style='font-size:10.5pt;
font-family:veranda;color:black'>alert icmp any any -> any any
(msg:"ICMP Destination Unreachable Communication Administratively
Prohibited"; icode:13; itype:3; classtype:misc-activity; sid:485; rev:4;) </span></font><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p></o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>I
cant find this and exclude it !!<o:p></o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>Where
is it?<o:p></o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>Thanks,<o:p></o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>

<p class=MsoNormal dir=LTR style='text-align:left;direction:ltr;unicode-bidi:
embed'><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>juan
<o:p></o:p></span></font></p>

<p class=MsoNormal dir=RTL><font size=2 face=Arial><span dir=LTR
style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>

</div>

</body>

</html>