snort rule: drop icmp scans from one host to class C subnet

This is a discussion on snort rule: drop icmp scans from one host to class C subnet within the Linux Security forums, part of the System Security and Security Related category; Hi, I have a ping server that keeps creating log entries in my snort logs. I want to filter those ...

		Usenet Forums > System Security and Security Related > Linux Security
snort rule: drop icmp scans from one host to class C subnet

LinkBack

Thread Tools

Search this Thread

Display Modes

#1 (permalink)

08-04-2004

blaqb0x

Posts: n/a

snort rule: drop icmp scans from one host to class C subnet

Hi,

I have a ping server that keeps creating log entries in my snort logs.
I want to filter those out. I'm using this rule in local.rules

pass icmp source_IP/32 any -> DEST_Network/24 any

It doesn't seem to work. what am I doing wrong?

Thanks,

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are Off [IMG] code is Off HTML code is Off Trackbacks are On Pingbacks are On Refbacks are On

All times are GMT +1. The time now is 03:18 AM.