ignore dhcp traffic from modem/router

[Philip Beattie <philip () computacraft co uk>]

Hello all,

I have a linux dhcp server running shorewall & snort with eth0 to 
private wired internal network & eth1 to modem/router.

The linux server is the only server and has static ip addresses.

The modem/router is also running a dhcp server for wireless laptops.

I'm getting snort alerts like;

[**] [1:527:8] BAD-TRAFFIC same SRC/DST [**]
[Classification: Potentially Bad Traffic] [Priority: 2]
03/24-07:51:47.937878 0.0.0.0:68 -> 255.255.255.255:67
UDP TTL:64 TOS:0x0 ID:16136 IpLen:20 DgmLen:333
Len: 305
[Xref => http://www.cert.org/advisories/CA-1997-28.html][Xref => 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=1999-0016][Xref => 
http://www.securityfocus.com/bid/2666]

which I believe are dhcp related from the modem/router.

When I look at the snort tcpdump.log files in wireshark I can see the 
traffic is originating from recognised wireless devices - laptops & tablets.

I'm a bit of a beginner.

Can I configure snort to ignore this dhcp traffic on my eth1 on the 
linux server ?

Can anyone give me some configuration suggestions ?

Debian Wheezy
Shorewall 4.5.5.3-3
Snort 2.9.2.2-3

Thanks very much

pappin

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!