How to keep internal traffic out of "HTTP decode"

[Marcus Vinícius de Melo Rocha <marcus () limiar com br>]

Hi all!

I am setting up a Linux box to run Snort in my net. I have noticed that both
inbound and outbound traffic are going through the "HTTP decode plugin". As
I have a lot of outbound traffic, I would like to avoid "HTTP decode"
looking at this traffic. Any ideas? I could use IPChains to keep this trafic
off my Linux box, but I would like to know if there's anything in Snort to
do the same.

Best regards,
Marcus


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users