Snort - Revision history

Paul Blankenbaker: Added external link

2007-03-29T14:12:00Z

Added external link

← Older revision		Revision as of 10:12, 29 March 2007
Line 25:		Line 25:

	</pre>		</pre>

			== References ==

			: [http://www.snort.org/docs/snort_htmanuals/htmanual_2.4/rc1/node11.html#SECTION00317000000000000000 sfPortscan Module] ; Notes on fine tuning the port scan module in '''Snort'''.

Paul Blankenbaker: /* Disabling Rules By ID */

2007-03-05T14:52:23Z

Disabling Rules By ID

← Older revision		Revision as of 10:52, 5 March 2007
Line 12:		Line 12:
	</pre>		</pre>

	NOTE: The file: "'''threshold.conf'''" is not loaded by default. So, you will also need to modify your '''snort''' configuration file(s). Search for: "'''threshold.conf'''" and uncomment as shown below:		NOTE: The file: "'''threshold.conf'''" is not loaded by default. So, you will also need to modify your '''snort''' configuration file(s). Search for: "'''threshold.conf'''" in the "'''snort.conf'''" file(s) and uncomment and modify it as shown below:

	<pre class="programListing">		<pre class="programListing">

Paul Blankenbaker: Fixed location of threshold.conf

2007-03-05T14:49:00Z

Fixed location of threshold.conf

← Older revision		Revision as of 10:49, 5 March 2007
Line 22:		Line 22:
	# such as: c:\snort\etc\threshold.conf		# such as: c:\snort\etc\threshold.conf
	# Uncomment if needed.		# Uncomment if needed.
	include threshold.conf		include $RULE_PATH/threshold.conf

	</pre>		</pre>

Paul Blankenbaker: Added information about disabling specify rules

2007-03-04T21:03:17Z

Added information about disabling specify rules

New page

=Snort Configuration Tips=

==Disabling Rules By ID==

One should be able to disable rules by adding the rule '''ID''' to the file: "'''threshold.conf'''" (located in the '''snort''' rules directory). For example, adding the following to the end of the file: "'''threshold.conf'''" should disable the: "''http_inspect: DOUBLE DECODING ATTACK''" and ''"http_inspect: OVERSIZE REQUEST-URI DIRECTORY"'' rules:

<pre class="programListing">

suppress gen_id 119, sig_id 2 # disable http_inspect: DOUBLE DECODING ATTACK alerts
suppress gen_id 119, sig_id 15 # disable http_inspect: OVERSIZE REQUEST-URI DIRECTORY alerts

</pre>

NOTE: The file: "'''threshold.conf'''" is not loaded by default. So, you will also need to modify your '''snort''' configuration file(s). Search for: "'''threshold.conf'''" and uncomment as shown below:

<pre class="programListing">

# Include any thresholding or suppression commands. See threshold.conf in the
# <snort src>/etc directory for details. Commands don't necessarily need to be
# contained in this conf, but a separate conf makes it easier to maintain them.
# Note for Windows users: You are advised to make this an absolute path,
# such as: c:\snort\etc\threshold.conf
# Uncomment if needed.
include threshold.conf

</pre>