Re: whitelist rule to 1 ip?

["Crook, Parker" <Parker_Crook () reyrey com>]

Morgan,



Sorry, it's early in the morning, but I'll run through the two polar opposites of blacklisting (suppression) and 
whitelisting of rules:



Blacklist - say I want to stop receiving alerts on sig_id 466 coming from 192.168.5.33; in the threshold file, I would 
put the following line:

suppress gen_id 1, sig_id 466, track by_dst, ip 192.168.5.33



Whitelist - say I only want to trigger alert 466 when it goes to 192.168.5.33; I would disable the alert (via 
pulledpork, so when I get rules updates it doesn't get re-enabled), and copy the contents over to my local.rules file, 
changing the destination from $HOME_NET to 192.168.5.33, so that the rule looked as follows:



alert icmp $EXTERNAL_NET any -> 192.168.5.33 any (msg:"ICMP L3retriever Ping"; icode:0; itype:8; 
content:"ABCDEFGHIJKLMNOPQRSTUVWABCDEFGHI"; depth:32; reference:arachnids,311; classtype:attempted-recon; sid:466; 
rev:5;)



I hope this is what you are asking; if not, let me know,

Parker



  _____

From: Morgan Cox [mailto:morgancoxuk () gmail com]
Sent: Wednesday, March 03, 2010 5:12 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] whitelist rule to 1 ip?



Hi.

I did ask this a while ago but never got a response.

What is the correct way of white-listing a rule for a specific IP .

I know that your can suppress warnings of a rule to an IP using the threshold file, but is thee any way to completely 
whitelist a rule - to 1 IP only?

Any help on this will be appreciated.

Regards

------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users