RE: CyberKit 2.2 Ping, its driven me Nuts..

["Thompson, Jimi" <JimiT () mail cox smu edu>]

All,

My personal preference is to re-write the rule to ignore external traffic.
I tend to block all PING traffic at the firewall.  I can't think of a good
reason that anyone would need to ping anything that's on my network.  If you
have something infected on your internal network, you should a) know about
it and b) fix it so completely disabling the rule really isn't an option to
me.

You can do this by reversing the "$EXTERNAL_NET any -> $HOME_NET" portion of
the rule to read "$HOME_NET any -> $EXTERNAL_NET" and adding a copy of the
rule ("$HOME_NET any -> $HOME_NET") to show traffic on your local network.  
These two should cause SNORT to catch any outbound or local traffic allowing
you to clean up your network and make better use of your bandwidth.  

HTH,

Jimi  

-----Original Message-----
From: Chris N [mailto:chris.northrop () po state ct us] 
Sent: Monday, December 29, 2003 12:52 PM
To: snort-users () lists sourceforge net;
snort-users-admin () lists sourceforge net
Subject: [Snort-users] CyberKit 2.2 Ping, its driven me Nuts..

Fellow Snorters,

Ok, I have had enough of this "CyberKit 2.2 Ping." How are some of you guys
dealing with it? Do you just ignore(pass), log every one, or go and try to
shut the offending hosts down? Although, trying to shutdown all the
offending host could be a daunting task, since there are so dam many.

Chris



-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users