Re: ignore dhcp traffic from modem/router

[Jeremy Hoel <jthoel () gmail com>]

You could use a threshold to suppress the source

suppress gen_id 1, sig_id 527 track by_src, ip 0.0.0.0

Or you can disable the rule all together.


On Wed, Mar 26, 2014 at 1:46 PM, Philip Beattie
<philip () computacraft co uk>wrote:

> Hello all,
>
> I have a linux dhcp server running shorewall & snort with eth0 to
> private wired internal network & eth1 to modem/router.
>
> The linux server is the only server and has static ip addresses.
>
> The modem/router is also running a dhcp server for wireless laptops.
>
> I'm getting snort alerts like;
>
> [**] [1:527:8] BAD-TRAFFIC same SRC/DST [**]
> [Classification: Potentially Bad Traffic] [Priority: 2]
> 03/24-07:51:47.937878 0.0.0.0:68 -> 255.255.255.255:67
> UDP TTL:64 TOS:0x0 ID:16136 IpLen:20 DgmLen:333
> Len: 305
> [Xref => http://www.cert.org/advisories/CA-1997-28.html][Xref =>
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=1999-0016][Xref =>
> http://www.securityfocus.com/bid/2666]
>
> which I believe are dhcp related from the modem/router.
>
> When I look at the snort tcpdump.log files in wireshark I can see the
> traffic is originating from recognised wireless devices - laptops &
> tablets.
>
> I'm a bit of a beginner.
>
> Can I configure snort to ignore this dhcp traffic on my eth1 on the
> linux server ?
>
> Can anyone give me some configuration suggestions ?
>
> Debian Wheezy
> Shorewall 4.5.5.3-3
> Snort 2.9.2.2-3
>
> Thanks very much
>
> pappin
>
>
> ------------------------------------------------------------------------------
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and their
> applications. Written by three acclaimed leaders in the field,
> this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/13534_NeoTech
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!