<div>
Hi,<br />
<br />
&nbsp; &nbsp;Did you try:<br />
# snort &lt;args&gt; not \( host &lt;ip&gt; \) <br />
<br />
Wesly<br />
<br />

</div>


Hi,

   Did you try:
# snort <args> not \( host <ip> \)

Wesly



<div>
I tried <br />
<br />
snort -D -c ..\etc\snort.conf &nbsp; not host 12.170.222.13 <br />
<br />
but that did not seem to work
</div>


I tried

snort -D -c ..\etc\snort.conf   not host 12.170.222.13

but that did not seem to work

<div>
<div class="content wysiwyg-content">
Can't quit figure out how to ignore a single computer.<br />
<br />
I have a computer which continuously gets following alert. &nbsp;It is because it<br />
is making lots of SNMP requests which is what it is suppose to do. &nbsp;How do I<br />
get snort to ignore a single host like this or just ignore this particular<br />
alert?<br />
<br />
thanks terry<br />
<br />
<br />
[**] [1:1417:9] SNMP request udp [**]<br />
[Classification: Attempted Information Leak] [Priority: 2]<br />
11/21-03:37:59.626234 12.170.222.13:53965 -&gt; 12.170.222.148:161<br />
UDP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:118 DF<br />
Len: 90<br />
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2002-0013" rel="ugc">http://cve.mitre.org/cgi-bin/cvename.cgi?name=2002-0013</a>]<br />
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2002-0012" rel="ugc">http://cve.mitre.org/cgi-bin/cvename.cgi?name=2002-0012</a><br />
<a href="http://www.securityfocus.com/bid/4132" rel="ugc">http://www.securityfocus.com/bid/4132</a>]<br />
<a href="http://www.securityfocus.com/bid/4089" rel="ugc">http://www.securityfocus.com/bid/4089</a>]<br />
<a href="http://www.securityfocus.com/bid/4088" rel="ugc">http://www.securityfocus.com/bid/4088</a>]<br />

</div>
</div>


Can't quit figure out how to ignore a single computer.

I have a computer which continuously gets following alert.  It is because it
is making lots of SNMP requests which is what it is suppose to do.  How do I
get snort to ignore a single host like this or just ignore this particular
alert?

thanks terry


[**] [1:1417:9] SNMP request udp [**]
[Classification: Attempted Information Leak] [Priority: 2]
11/21-03:37:59.626234 12.170.222.13:53965 -> 12.170.222.148:161
UDP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:118 DF
Len: 90
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2002-0013]
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2002-0012
http://www.securityfocus.com/bid/4132]
http://www.securityfocus.com/bid/4089]
http://www.securityfocus.com/bid/4088]


SNORT and ignoring hosts

The Linux operating system, in all its flavors, has its own share of security flaws that allow intrusions, but there are various mechanisms by which these flaws can be removed, generally divided into two parts: authentication and access control. Authentication is responsible for ensuring that a user requesting access to the system is really the user with the account, while access control is responsible for controlling which resources each account has access to and what kind of access is permitted.