Re: icmp i want to ignore

[Erek Adams <erek () theadamsfamily net>]

On Wed, 5 Jun 2002, Don wrote:

> the following rule in icmp.rules
> alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP L3retriever Ping";
> content: "ABCDEFGHIJKLMNOPQRSTUVWABCDEFGHI"; itype: 8; icode: 0; depth: 32;
> reference:arachnids,311; classtype:attempted-recon; sid:466; rev:1;)
> triggers an alert for me i wish to ignore, from 1 source IP address, I know
> what causes it on this source, so i wish to ignore this source only, what
> would be the best way for this?
> any suggestions

FAQ'able info folks...  :)

  You have two options.  It depends on how you want to approach it, as to your
choice.

        1)  BPF Filters
        2)  Pass Rule(s)

Now, each of these have good and bad points.  You need to consider which would
work the best for you.

        1)  BPF Filter
              Good:  1)  Drops the packet at the BPF interface.  Saves on
processing power.
                     2)  Speeds up Snort since it 'never sees' those packets.
              Bad:   1)  Poorly constructed filters can 'blind-side' your
whole network.

        2)  Pass Rule
              Good:  1)  Gives you rule based control over the packets.
                     2)  Puts all your changes into 'one place'--snort.conf
and it's rule files.
              Bad:   1)  Reverses the Rule order, can cause some headaches in
tracing down problems.
                     2)  One poorly written pass rule can 'blind' your whole
network.
                     3)  The more specific the pass rule is, the more CPU
snort needs to process it.


  I would post examples of each, but I don't have my Snort Users-Guide and
Stephens book here to double check myself with.   I'll post a pair of examples
of each later tomorrow--Unless someone else beats me to it! ;-)

  Since this has been reviewed here (snort-users) quite a bit, there should be
a lot of info in the archives.  Phil Wood has posted a nice generic BPF
'ignore file' about 3-4 weeks ago (sorry, no URL handy).  There have also been
quite a few postings regarding how to ignore things with pass rules.  Have a
look over the mailing list archives and see if any of that info there make
sense.

        Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users