LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 02-05-2014, 09:30 AM   #1
trtrb
LQ Newbie
 
Registered: Jan 2014
Posts: 14

Rep: Reputation: Disabled
Snort alerts


i have false alert that spam all my log file of snort how can i
disable this rule:

[**] [1:402:7] ICMP Destination Unreachable Port Unreachable [**]
[Classification: Misc activity] [Priority: 3]
02/05-14:51:36.448330 x.x.x..x.x > x.x.x.x
ICMP TTL:48 TOS:0x0 ID:60609 IpLen:20 DgmLen:68
Type:3 Code:3 DESTINATION UNREACHABLE: PORT UNREACHABLE
** ORIGINAL DATAGRAM DUMP:
x.x.x.x.x -> x.x.x.x.x
TCP TTL:54 TOS:0x0 ID:2497 IpLen:20 DgmLen:40 DF
Seq: 0x99DEB0B6
(12 more bytes of original packet)
** END OF DUMP

[**] [1:402:7] ICMP Destination Unreachable Port Unreachable [**]
[Classification: Misc activity] [Priority: 3]
02/05-14:51:36.448759 x.x.x.x.x -> x.x.x.x.x
ICMP TTL:48 TOS:0x0 ID:60610 IpLen:20 DgmLen:68
Type:3 Code:3 DESTINATION UNREACHABLE: PORT UNREACHABLE
** ORIGINAL DATAGRAM DUMP:
x.x.x.x..x -> x.x.x.x..x
TCP TTL:54 TOS:0x0 ID:2498 IpLen:20 DgmLen:40 DF
Seq: xxxx
(12 more bytes of original packet)
** END OF DUMP
 
Old 02-05-2014, 12:33 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Rule with SID 402 is in /etc/snort/rules/icmp-info.rules, see /etc/snort/threshold.conf for how to suppress it.
 
Old 02-05-2014, 01:08 PM   #3
trtrb
LQ Newbie
 
Registered: Jan 2014
Posts: 14

Original Poster
Rep: Reputation: Disabled
in /etc/snort/threshold.conf

i see this:
Suppress this event completely:

i should do that ?
1)Suppress this event completely: ICMP Destination Unreachable Port Unreachable
 
Old 02-06-2014, 01:43 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by trtrb View Post
in /etc/snort/threshold.conf

i see this:
Suppress this event completely:

i should do that ?
If you want to, yes. Use the rules Snort Id (SID), not the trivial name.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Snort - no portscan and tcp alerts in snort av.dubey Linux - Software 6 07-11-2008 09:56 PM
How many alerts a day do you get on snort? abefroman Linux - Software 7 05-06-2008 07:53 AM
snort alerts lord-fu Linux - Security 1 11-25-2005 03:28 PM
Snort Alerts ?? zahra79 Linux - Networking 5 06-22-2005 05:11 AM
Snort Alerts knight_ridda Linux - Security 13 06-21-2003 04:32 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 11:26 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration