Assuming you have correctly defined the variables in the /etc/snort.conf file paying close attention to the $HOME_NET and $EXTERNAL_NET variables you might want to consider a BPF filter on your input.
On Fri, 2007-12-14 at 13:09 -0500, Jonathan Askew JBASKEW wrote: > I am new to IDS and have just set up snort on a ubuntu host. It has worked > well except for the fact that I am getting some false positivies from local > traffic on the network. I have been trying to find the solution on snort's > forums but the site seems to be going up and down randomly. I want to set a > rule in order to suppress/ignore local network traffic for 192.168.1.0/24. > I know this can be done in the /etc/threshold.conf file but have not been > able to do so successfully. Can someone be so kind as to post their > threshold.conf file or guide me through the process? > > Thanks, > Blake > > > ------------------------------------------------------------------------ > Test Your IDS > > Is your IDS deployed correctly? > Find out quickly and easily by testing it > with real-world attacks from CORE IMPACT. > Go to > http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw > > to learn more. > ------------------------------------------------------------------------ > ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
