Re: re: Pass Rule question

["Kenneth G. Arnold" <bkarnold () cbu edu>]

Did you add the file pass.rules to the snort.conf file with all the other 
rules files?

e.g.
include $RULE_PATH/pass.rules

I would suggest that you create a variable in snort.conf. e.g. SNMP_DEST

var SNMP_DEST [y.y.y.y/32,z.z.z.z/32]

Then add a line similar to the following to pass.rules:

pass udp x.x.x.x/32 any -> $SNMP_DEST 161

If you want to add any additional destinations in the future, you will only 
need to add more IP addresses to the variable.

Ken
At 09:32 AM 6/11/2003 -0400, lindsay.hunt () itc alstom com wrote:
> Hello,
>
> I have a question regarding the use of pass rules. I am running snort with
> the "-o" option and want to ignore specific snmp traffic; specifically,
> snmp requests from a particular ip address destined for 2 separate
> addresses.
>
> I created a file called pass.rules and placed it in the rules directory. It
> has the following syntax:
>
>      pass udp x.x.x.x any -> udp [y.y.y.y , z.z.z.z ] 161
>
>
> x.x.x.x corresponds to the source address and y and z to the destination
> addresses.
>
> Is the syntax correct? The traffic that I want to ignore is still showing
> up as alerts.  Thanks in advance for any help.
>
>
> kind regards,
>
> Lindsay Hunt
> Network Engineer
> Alstom Power
> phone 804-763-7239
> mobile 804-334-1682
> fax 804-763-7107
>
>
> CONFIDENTIALITY : This e-mail and any attachments are confidential and may
> be privileged. If you are not a named recipient, please notify the sender
> immediately and do not disclose the contents to another person, use it for
> any purpose or store or copy the information in any medium.
>
>
>
> -------------------------------------------------------
> This SF.NET email is sponsored by: eBay
> Great deals on office technology -- on eBay now! Click here:
> http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


Brother Kenneth Arnold
System Administrator
Information Technology Services
Christian Brothers University
(901) 321-4333



-------------------------------------------------------
This SF.NET email is sponsored by: eBay
Great deals on office technology -- on eBay now! Click here:
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users