Re: disabling specific snort rules

[waldo kitty <wkitty42 () windstream net>]

On 10/24/2013 10:42 AM, Roland RoLaNd wrote:
> Thank you james,
> that did it for me.
>
> another question related to rules if i may ?
> i'm receiving high alert of false positive. using BASE i'm getting thousands of
> alerts to a specific destination which is my own remote server.
> may i ask of a way to exclude certain destinations (IPs or ports)  from
> triggering alerts?

FWIW: you really should start a new thread for each situation you encounter...

why? so the newer question(s) do not get lost in a thread that others have 
ignored because they had no input for that original thread... if they can help 
with your new situation, you are inadvertently preventing them from doing so...

it also helps others to find similar problems to their own when they search the 
archives ;)

-- 
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60135991&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!