Snort mailing list archives
Re: SSH MISMATCH
From: "Jefferson, Shawn" <Shawn.Jefferson () bcferries com>
Date: Thu, 18 Oct 2012 16:18:13 -0600
Pre-processors rules are "built-in" to snort, and when you compile snort you can specify that you want to enable pre-processor rules (I typically use --enable-sourcefire which enables some other options you'll most likely want as well.) Then you need to have the pre-processor rules files specified in your snort.conf as well. You can then disable rules in these files like you mention. Make sure to -HUP snort to get it to re-read the rule config (I'm pretty sure that works for pre-processor rules as well-someone correct me if I'm wrong.) -----Original Message----- From: AllowOverride [mailto:allowoverride () gmail com] Sent: Wednesday, October 17, 2012 3:10 PM To: snort-users Subject: [Snort-users] SSH MISMATCH i am trying to turn off this alert in preproc_rules/preprocessor.rules: #alert ( msg: "SSH_EVENT_PROTOMISMATCH"; sid: 4; gid: 128; rev: 1; metadata: rule-type preproc, service ssh ; classtype:non-standard-protocol;) i commented it out, still it shows up in base. which leads to another logical question: how can one find out where a rule lives in the first place. i figured out from base if i mouse over the snort portion it states: 128-4 which i figured you can grep 128 goto the file, 4 entries down, find it that way. 1. is there another easier way to find them? 2. lastly, how can i turn it off 128-4 for good. thanks ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_sfd2d_oct _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news! ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_sfd2d_oct _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- SSH MISMATCH AllowOverride (Oct 18)
- Re: SSH MISMATCH Jefferson, Shawn (Oct 18)
- Re: SSH MISMATCH Michael Steele (Oct 18)
- Re: SSH MISMATCH AllowOverride (Oct 18)
- Re: SSH MISMATCH Joel Esler (Oct 19)
- Re: SSH MISMATCH Castle, Shane (Oct 19)
- Re: SSH MISMATCH Joel Esler (Oct 19)
- Re: SSH MISMATCH AllowOverride (Oct 19)
- Re: SSH MISMATCH waldo kitty (Oct 21)
- Re: SSH MISMATCH AllowOverride (Oct 18)