Re: Snort Network Suppression

[Matteo Ignaccolo <matteo.ignaccolo () gmail com>]

Jonathan Askew JBASKEW wrote:

> I am new to IDS and have just set up snort on a ubuntu host.

Which snort version?
On debian and debian based distros, as ubuntu, yuo will find only old  
versions of snort.
For example, this summer on official ubuntu mirror was available  
Snort 2.3.3, when the latest STABLE release was the 2.7
IMHO the best way to use snort on ubuntu is compile latest stable  
release.

> It has worked
> well except for the fact that I am getting some false positivies  
> from local
> traffic on the network.

Have you set the proper rules set for your network?

> I want to set a rule in order to suppress/ignore local network  
> traffic for 192.168.1.0/24.
> I know this can be done in the /etc/threshold.conf file but have  
> not been
> able to do so successfully.

The correct solution is the tip in Boogie B. answer.
If I remember well, during installation you set your internal network  
IP address and subnet, but the external net is sets to "any" as default
Remember that is not a good choice suppress all traffic from internal  
host, because you'll be not able to detect anomaly activity that  
starts from internal host.

--
Matteo Ignaccolo



------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------