<div>
More info on the question:<br />
Source IP &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Dest IP &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Port<br />
10.11.11.11 &nbsp; &nbsp; &nbsp;10.11.12.13 &nbsp; &nbsp; &nbsp;80 &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Snort &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;WEB-CGI finger access<br />
<br />
So I want this SNORT rule to ignore when DestIP is 0.11.12.13 
</div>


More info on the question:
Source IP          Dest IP           Port
10.11.11.11      10.11.12.13      80         Snort         WEB-CGI finger access

So I want this SNORT rule to ignore when DestIP is 0.11.12.13

<div>
Hello,<br />
<br />
First find snort attack id number for this attack.<br />
<br />
Please open the threshold.conf file. and goto last line and<br />
<br />
suppress gen_id 122, sig_id 27, track by_src, ip 192.168.1.0/24<br />
<br />
(gen id 122 and signature id 27 not collect from the 192.168.1.0/24 network)<br />
<br />
<br />
<br />
<br />
<a href="https://filedb.experts-exchange.com/incoming/2010/09_w38/347990/14.09.jpg" target="_blank" class="file-inline" title="findattackid (294 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>14.09.jpg</a>
</div>


Hello,

First find snort attack id number for this attack.

Please open the threshold.conf file. and goto last line and

suppress gen_id 122, sig_id 27, track by_src, ip 192.168.1.0/24

(gen id 122 and signature id 27 not collect from the 192.168.1.0/24 network)




14.09.jpg [https://filedb.experts-exchange.com/incoming/2010/09_w38/347990/14.09.jpg]

14.09.jpg

<div>
How do you modify the SNORT rule?
</div>


<div>
Great, thanks for the lead.
</div>


<div>
<div class="content wysiwyg-content">
How do I change the snort rule to ignore when destination IP (e.g. desIP is 10.11.12.13)<br />
<br />
alert tcp $EXTERNAL_NET any -&gt; $HTTP_SERVERS $HTTP_PORTS (msg:&quot;WEB-CGI finger access&quot;; flow:to_server,established<wbr />; uricontent:&quot;/finger&quot;; nocase; metadata:service http; reference:arachnids,221; reference:cve,1999-0612; reference:nessus,10071; classtype:attempted-recon;<wbr /> sid:839; rev:8;)
</div>
</div>


How do I change the snort rule to ignore when destination IP (e.g. desIP is 10.11.12.13)

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-CGI finger access"; flow:to_server,established; uricontent:"/finger"; nocase; metadata:service http; reference:arachnids,221; reference:cve,1999-0612; reference:nessus,10071; classtype:attempted-recon; sid:839; rev:8;)

Snort, Modify snort rule &quot;WEB-CGI finger access&quot; to ignore destination IP

Anti-virus software was originally developed to detect and remove computer viruses. However, with the proliferation of other kinds of malware, antivirus software started to provide protection from other computer threats. In particular, modern antivirus software can protect from malicious browser helper objects (BHOs), browser hijackers, ransomware, keyloggers, backdoors, rootkits, trojan horses, worms, malicious layered service providers (LSPs), dialers, fraud tools, adware and spyware. Some products also include protection from other computer threats, such as infected and malicious URLs, spam, scam and phishing attacks, online identity theft (privacy), online banking attacks, social engineering techniques, Advanced Persistent Threat (APT), botnets and DDoS attacks.

Snort, Modify snort rule &quot;WEB-CGI finger access&quot; to ignore destination IP

Snort, Modify snort rule "WEB-CGI finger access" to ignore destination IP