How to disable SID from built-in ruleset?

[Ernesto Arias via Snort-sigs <snort-sigs () lists snort org>]

Hello -

I am using snort v3.9.3 for an IDS application, it is sending false positives alerts for multiples SID below 1,000,000 
which are included in the built-in configuration. See example below

2/24/2026 11:21
notice
snort[887]:
[116:444:1]
(ipv4) IPv4 option set
[Priority:
3]
{IGMP}
10.2.0.64
->
224.0.0.22
2/24/2026 11:21
notice
snort[887]:
[116:444:1]
(ipv4) IPv4 option set
[Priority:
3]
{IGMP}
10.2.0.66
->
224.0.0.22
2/24/2026 11:21
notice
snort[887]:
[116:444:1]
(ipv4) IPv4 option set
[Priority:
3]
{IGMP}
10.2.0.30
->
224.0.0.22
2/24/2026 11:21
notice
snort[887]:
[116:444:1]
(ipv4) IPv4 option set
[Priority:
3]
{IGMP}
10.2.0.68
->
224.0.0.22
2/24/2026 11:21
notice
snort[887]:
[116:444:1]
(ipv4) IPv4 option set
[Priority:
3]
{IGMP}
10.2.0.60
->
224.0.0.22
2/24/2026 11:21
notice
snort[887]:
[116:444:1]
(ipv4) IPv4 option set
[Priority:
3]
{IGMP}
169.254.105.73
->
224.0.0.22
2/24/2026 11:21
notice
snort[887]:
[116:444:1]
(ipv4) IPv4 option set
[Priority:
3]
{IGMP}
169.254.105.73
->
224.0.0.22
2/24/2026 11:21
notice
snort[887]:
[116:444:1]
(ipv4) IPv4 option set
[Priority:
3]
{IGMP}
10.2.0.72
->
224.0.0.22
2/24/2026 11:21
notice
snort[887]:
[116:444:1]
(ipv4) IPv4 option set
[Priority:
3]
{IGMP}
169.254.105.73
->
224.0.0.22
2/24/2026 11:21
notice
snort[887]:
[116:444:1]
(ipv4) IPv4 option set
[Priority:
3]
{IGMP}
10.2.0.3
->
224.0.0.22
2/24/2026 11:21
notice
snort[887]:
[116:444:1]
(ipv4) IPv4 option set
[Priority:
3]
{IGMP}
10.2.0.70
->
224.0.0.22
2/24/2026 11:21
notice
snort[887]:
[116:444:1]
(ipv4) IPv4 option set
[Priority:
3]
{IGMP}
10.0.0.10
->
224.0.0.22
2/24/2026 11:21
notice
snort[887]:
[116:444:1]
(ipv4) IPv4 option set
[Priority:
3]
{IGMP}
10.2.0.50
->
224.0.0.22

I tried disabling these SID using a new file specified in the lua file, but the IDS keeps sending these alerts

# lua file
{
    enable_builtin_rules = true,  -- Enable Snort built-in rules (adjust if needed)
    variables = ips_variables,
                  rules = [[
        include /mnt/app/ccurrent/platform/etc/snort.rules
        include /mnt/app/ccurrent/platform/etc/disabled.rules
    ]]
}

#######################
# This file defines SNORT rules to disable for the IDS Config specific to the vehicle network.
#######################
notice igmp any any -> any any (gid:116; sid:444; enable:no;)
notice icmp any any -> any any (gid:116; sid:436; enable:no;)
notice udp any any -> any any (gid:122; sid:23; enable:no;)
notice tcp any any -> any any (gid:128; sid:6; enable:no;)
notice tcp any any -> any any (gid:137; sid:2; enable:no;)

I researched about using disableSID.conf file but apparently it only works with snort v2

Could you please let me know how to disable SID from built-in ruleset?

Ernesto Arias
Systems Architect

[A close-up of a logo  Description automatically generated]<http://www.questertangent.com/>


________________________________

QTC365EU This transmission is confidential and intended solely for the addressee and for its intended purpose. If you 
are not the intended recipient, please immediately inform the sender and delete the message and any attachments from 
your system. Please note that any views or opinions presented in this email are solely those of the author and do not 
necessarily represent those of QTC. No employee or agent is authorised to conclude any binding agreement on behalf of 
QTC with another party by email without express written confirmation by an officer of the company. The organization 
accepts no liability for any damage arising out of transmission failures, viruses, external influence, delays and the 
like.

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!