<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>What is the difference between that and putting them in $EXTERNAL_NET with telling them to not include using a exclamation point in front of IPs?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Brant Wells [mailto:bwells@tfc.edu] <br><b>Sent:</b> Friday, June 20, 2014 1:06 PM<br><b>To:</b> Leonard Jacobs<br><b>Cc:</b> Darien Huss; OISF Users<br><b>Subject:</b> Re: [Oisf-users] How do you ignore External IP Addresses?<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>You could also add the IP Ranges that you want to ignore to the $HOME_NET variable... <o:p></o:p></p><div><p class=MsoNormal> <o:p></o:p></p></div><div><p class=MsoNormal>$HOME_NET = [<a href="http://10.0.0.0/16">10.0.0.0/16</a>, <a href="http://192.168.1.0/24">192.168.1.0/24</a>, <a href="http://8.8.8.8/32">8.8.8.8/32</a>]<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Or something like that to make it ignore the servers that you don't want to monitor traffic from.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><p class=MsoNormal>On Fri, Jun 20, 2014 at 12:23 PM, Leonard Jacobs <<a href="mailto:ljacobs@netsecuris.com" target="_blank">ljacobs@netsecuris.com</a>> wrote:<o:p></o:p></p><p class=MsoNormal>I am trying to avoid customizing a standard signature because updating becomes problematic then.<o:p></o:p></p><div><div><p class=MsoNormal style='margin-bottom:12.0pt'><br>----- Original Message -----<br>From: Darien Huss [mailto:<a href="mailto:dhuss@emergingthreats.net">dhuss@emergingthreats.net</a>]<br>To: Leonard Jacobs [mailto:<a href="mailto:ljacobs@netsecuris.com">ljacobs@netsecuris.com</a>]<br>Cc: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>Sent: Fri, 20 Jun 2014 06:59:49 -0500<br>Subject: Re: [Oisf-users] How do you ignore External IP Addresses?<br><br><br>> Without seeing the traffic I'm not sure if this would be reliable, but you<br>> could possibly add something like this to that rule if the test webpage<br>> occurs on the same domain every time:<br>><br>> content:!"<a href="http://trustedvendor.com" target="_blank">trustedvendor.com</a>"; http_header;<br>><br>> If their IP address were to change but the domain stays the same the above<br>> would still work.<br>><br>> Regards,<br>><br>> Darien<br>><br>><br>> On Fri, Jun 20, 2014 at 7:24 AM, Leonard Jacobs <<a href="mailto:ljacobs@netsecuris.com">ljacobs@netsecuris.com</a>><br>> wrote:<br>><br>> > I want to be able to ignore some External source IP addresses in<br>> > signatures. Can I list them in suricata.yaml with a ! in front of them.<br>> > Like:<br>> ><br>> ><br>> ><br>> > EXTERNAL_NET: "[!$HOME_NET, !x.x.x.x, !x.x.x.x/16]" for example.<br>> ><br>> ><br>> ><br>> > I have a trusted vendor that is causing false positives because they<br>> > refuse to change a numeric string in what they are sending in a test web<br>> > page so it is triggering a Trojan signature. I want to ignore their<br>> > traffic. I know that is dangerous if they were really used as an attack<br>> > vector into my network.<br>> ><br>> ><br>> ><br>> > Any suggestions?<br>> ><br>> ><br>> ><br>> > Leonard<br>> ><br>> ><br>> ><br>> ><br>> ><br>> ><br>> ><br>> > _______________________________________________<br>> > Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>> > Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>> > List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>> > OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br>> ><br>><br><br><o:p></o:p></p></div></div><p class=MsoNormal>Leonard Jacobs, MBA, CISSP, CSSAPresident/CEONetsecuris Inc.P <a href="tel:952-641-1421%20ext.%2020">952-641-1421 ext. 20</a><a href="http://www.netsecuris.com" target="_blank">http://www.netsecuris.com</a><o:p></o:p></p><div><div><p class=MsoNormal>_______________________________________________<br>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><o:p></o:p></p></div></div></div><p class=MsoNormal><br><br clear=all><o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal>-- <o:p></o:p></p><div><p class=MsoNormal><span style='font-family:"Verdana","sans-serif"'>~Brant Wells</span><o:p></o:p></p><div><p class=MsoNormal><span style='font-size:7.5pt;font-family:"Georgia","serif"'>Network Administrator</span><o:p></o:p></p><div><p class=MsoNormal><span style='font-size:7.5pt;font-family:"Georgia","serif"'>Toccoa Falls College</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:7.5pt;font-family:"Georgia","serif"'>107 Kincaid Drive Toccoa Falls, GA 30598</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:7.5pt;font-family:"Georgia","serif"'>706-886-7299 x5346 * <a href="mailto:bwells@tfc.edu" target="_blank">bwells@tfc.edu</a></span><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div></div></div></div></div></div></body></html>