Re: PIM - Multicasts

[Eric Maheo <eric.maheo () appliedwatch com>]

Well you have several options:

-disable the rule 2189 for your snort listening the internal network
-set a suppress for this sig and a particular ip source or destination
-set a threshold
-set the correct variables for this rule 2189

Thanks,
Eric 


On Tue, 2005-08-23 at 12:07 -0500, Walt Rich wrote:
> I've been fairly successful in tuning snort in our environment, and
> have reduced the number of false positives dramatically.   I have a
> question though: How do I disable the PIM alerts generated by Snort
> for our internal network?  I constantly receive 
>  
> BAD_TRAFFIC IP Proto 103 PIM alerts.  We run multicasting on our
> internal network because we use Norton Ghost to setup workstations.
> The Ghostcasting feature requires the enabling of multicasting, and we
> don't need to see these alerts.
>  
> Thanks!
>  
>                         Parago Logo
>
> ___________________________________
> | Walt Rich | Sr. Network
> Engineer | Parago, Inc. |
> 972.538.7253 | walt.rich () parago com
> |
>  
-- 

Eric Maheo
Vice President of Engineering,

Applied Watch Technologies, LLC
1095 Pingree Rd.
Suite 212
Crystal Lake, IL 60014

Tel: (877) 262-7593 x324
Fax: (877) 262-7593

Email: eric.maheo () appliedwatch com
Web: http://www.appliedwatch.com



-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users