Re: disabling specific snort rules

[Roland RoLaNd <r_o_l_a_n_d () hotmail com>]

James, yes that was of tremendous help. 
Do you suggest of any ebook or site i can learn more about snort? 
you,others and this list in general have helped me every time i asked a question which i'm thankful for, but i want to 
start learning snort all together instead of getting answers about specific questions.The only ebooks i could find 
dates 2004..2006 ...

> To: snort-users () lists sourceforge net
> Date: Thu, 24 Oct 2013 09:59:47 -0600
> From: jlay () slave-tothe-box net
> Subject: Re: [Snort-users] disabling specific snort rules
>
> On 2013-10-24 08:42, Roland RoLaNd wrote:
> > Thank you james,
> > that did it for me.
> >
> > another question related to rules if i may ?
> > i'm receiving high alert of false positive. using BASE i'm getting
> > thousands of alerts to a specific destination which is my own remote
> > server.
> > may i ask of a way to exclude certain destinations (IPs or ports) 
> > from
> > triggering alerts?
>
> Check out the threshold.conf file for getting IP's to stop 
> alerting...also works with specific rules.  If you're sure you don't 
> want to see a specific host ever, then I'd use a bpf when starting 
> snort:
>
> snort -c /etc/snort/conf "not myserverip"
>
> for example.  Hope that helps.
>
> James
>
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60135991&iu=/4140/ostg.clktrk
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60135991&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!