Snort mailing list archives
Help to configure SNORT
From: Lorenzo Rossi <condor_rl () libero it>
Date: Tue, 23 Dec 2003 22:25:15 +0100
Hi, I'm new to snort. I have installed it and configured to work with MYSQL and AICD, all seems work fine. My problem is that I would like to tune snort to avoid false positive. I decided to read the reports of ACID to see what type of alerts are present. Now I can see lots of lines like this: ------------------------------------------------------ #0-(1-8) (spp_stream4) TCP CHECKSUM CHANGED ON RETRANSMISSION (possible fragroute) detection 2003-12-09 00:10:58 192.168.1.3:32955 146.48.80.4:993 TCP --------------------------------------------------------------- #1-(1-9) (spp_stream4) possible EVASIVE RST detection 2003-12-09 00:11:25 192.168.1.3:33587 146.48.80.4:995 TCP -------------------------------------------------------------- I would like to avoid this alerts because 146.48.80.4 is the e-mail server of my ISP! I can also see lots of lines of the same type but the destination address are some Internet Servers like "www" and "ftp" Could you help me to solve this problem? Thanks Lorenzo ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Help to configure SNORT Lorenzo Rossi (Dec 23)
- Re: Help to configure SNORT Matt Kettler (Dec 23)
- Re: Help to configure SNORT Lorenzo Rossi (Dec 23)
- Re: Help to configure SNORT Matt Kettler (Dec 24)
- Re: Help to configure SNORT Lorenzo Rossi (Dec 23)
- <Possible follow-ups>
- Help to configure SNORT Lorenzo Rossi (Dec 30)
- Re: Help to configure SNORT Matt Kettler (Dec 23)