RE: re: Pass rule question

["adam.w.hogan" <adam.w.hogan () delphi com>]

Looks like a small syntax error.  Take out the second 'udp' you have in
the rule, and then it should work.

     pass udp x.x.x.x any -> [y.y.y.y , z.z.z.z ] 161

-----Original Message-----
From: lindsay.hunt () ustug net [mailto:lindsay.hunt () ustug net]
Sent: Wednesday, June 11, 2003 1:28 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] re: Pass rule question


Hello,

I have a question regarding the use of pass rules. I am running snort
with
the "-o" option and want to ignore specific snmp traffic; specifically,
snmp requests from a particular ip address destined for 2 separate
addresses.

I created a file called pass.rules and placed it in the rules directory.
It
has the following syntax:

     pass udp x.x.x.x any -> udp [y.y.y.y , z.z.z.z ] 161


x.x.x.x corresponds to the source address and y and z to the destination
addresses.

Is the syntax correct? The traffic that I want to ignore is still
showing
up as alerts.  Thanks in advance for any help.


kind regards,

Lindsay Hunt
Network Engineer
Alstom Power
phone 804-763-7239
mobile 804-334-1682
fax 804-763-7107

Lindsay Hunt
Network Engineer
Alstom Power
phone 804-763-7239
mobile 804-334-1682
fax 804-763-7107

CONFIDENTIALITY : This e-mail and any attachments are confidential and
may
be privileged. If you are not a named recipient, please notify the
sender
immediately and do not disclose the contents to another person, use it
for
any purpose or store or copy the information in any medium.



-------------------------------------------------------
This SF.NET email is sponsored by: eBay
Great deals on office technology -- on eBay now! Click here:
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.NET email is sponsored by: eBay
Great deals on office technology -- on eBay now! Click here:
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users