If I understand your question fully I would think that in the /etc/snort/snort.conf file you should be able to change the monitor network to just your external so you do not monitor the internal network. It has been a few years since I used snort but I def suggest checking that file out and restarting snort.
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jonathan Askew JBASKEW Sent: Friday, December 14, 2007 1:10 PM To: [email protected] Subject: Snort Network Suppression I am new to IDS and have just set up snort on a ubuntu host. It has worked well except for the fact that I am getting some false positivies from local traffic on the network. I have been trying to find the solution on snort's forums but the site seems to be going up and down randomly. I want to set a rule in order to suppress/ignore local network traffic for 192.168.1.0/24. I know this can be done in the /etc/threshold.conf file but have not been able to do so successfully. Can someone be so kind as to post their threshold.conf file or guide me through the process? Thanks, Blake ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=in tro_sfw to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
