Supressing alerts.

[chubeshoi () chubes com]

Hi all.

Was wondering if you could help me suppress some alerts on my new snort 
box.  Currently
[snort] (portscan) Open Port   unclassified
[snort] (portscan) UDP Portsweep   unclassified
[snort] (http_inspect) BARE BYTE UNICODE ENCODING

Are generating too many alerts.  I have attempted to suppress these 
alerts in my snort.conf file like the following:
suppress gen_id 1, sig_id 27:
suppress gen_id 1, sig_id 19:
suppress gen_id 1, sig_id 4:

But those alerts keep on flooding my SQL database.  Am I using the 
correct signature ID numbers?  I don't know what else to try.

Thanks.



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users