New to the list--Question

["Eric Joe" <sysop () tje1 com>]

Hello everyone,
I am new to the Snort list and forgive me if this question is asked a lot,
but I am trying to determine the source of a bunch of alerts between 2 of
my servers. Here is a snip from my SnortSnarf output (with IPs changed)
SNMP public access udp

[**] [1:1411:2] SNMP public access udp [**]
[Classification: Attempted Information Leak] [Priority: 2]
07/10-19:03:31.592176 192.168.1.3:44761 -> 192.168.1.212:161
UDP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:117 DF
Len: 97

I have about 16k+ of these alerts. The .212 box is actually my Snort boxe 
with a fresh install of RH7.3  The other box does mail/dns/radius/web. I
dont have any SNMP turned on (intentionally anyway).
If I can find the source, I want to tell Snort to ignore it.

Any help is greatly appreciated.

-- 
Eric Joe
Network Operations
Journey's End Internet/Computer Connection Inc




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
PC Mods, Computing goodies, cases & more
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users