RE: How to disable a single Rule for some Hosts?

["McPheeters, Scott" <smcpheeters () fnms-indy com>]

I normally copy the rule to local.rules, then edit the source/destination and change from alert to pass (I run -o, 
which let's the pass rules go first)

Scott

-----Original Message-----
From: Christian Brem [mailto:christian () brem at]
Sent: Tuesday, February 18, 2003 4:58 AM
To: snort
Subject: [Snort-users] How to disable a single Rule for some Hosts?


Hi,

I just got everything running, snort 1.9, mysql, acid and a windows based
policy editor and

... im happy (just in case someone cares :) - and gratulations to
developers - fine work!! (just in case you read this)


But I have a problem: I have to leave some rules to be active which generate
false alarms for "trusted" Hosts (on different nets).

Now I want to deactivate specific rules for this hosts? I was reading the
manual - but didn't get the point (if there is one than it makes me really
unhappy that I didn't get it :)

Thanks for any enlightment in advance!

greetings, Christian


Christian Brem, Vienna/Austria









-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users