Help to configure SNORT

[Lorenzo Rossi <lorenzo.rossi-hall () poste it>]

Hi, I'm new to snort.

I have installed it and configured to work with MYSQL and AICD, all
seems work fine.
My problem is that I would like to tune snort to avoid false positive.

I decided to read the reports of ACID to see what type of alerts are
present.

Now I can see lots of lines like this:

------------------------------------------------------
#0-(1-8)

(spp_stream4) TCP CHECKSUM CHANGED ON RETRANSMISSION (possible
fragroute) detection

2003-12-09 00:10:58

192.168.1.3:32955
146.48.80.4:993
TCP   
---------------------------------------------------------------

#1-(1-9)

(spp_stream4) possible EVASIVE RST detection

2003-12-09 00:11:25

192.168.1.3:33587
146.48.80.4:995
TCP   
--------------------------------------------------------------

I would like to avoid this alerts because 146.48.80.4 is the e-mail
server of my ISP!

I can also see lots of lines of the same type but the destination
address are some Internet Servers like "www" and "ftp"


Could you help me to solve this problem?


Thanks

Lorenzo



-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users