<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I actually created a new variable in suricata.yaml that includes the entire needed set of source IP addresses; which I applied in a custom pass rule. It works great.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Thanks.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Leonard<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Brant Wells [mailto:bwells@tfc.edu] <br><b>Sent:</b> Monday, June 23, 2014 7:25 AM<br><b>To:</b> Leonard Jacobs<br><b>Cc:</b> Darien Huss; OISF Users<br><b>Subject:</b> Re: [Oisf-users] How do you ignore External IP Addresses?<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>Hey Leonard,<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>There's not really much of a difference in doing that. But it is another way to skin the cat, so to speak. I usually put things I want to ignore (ie: Venor IPs) in the Home_Net, since we generally trust the IP addresses.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Like I said though... Either way *should* work.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>~Brant<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><p class=MsoNormal>On Fri, Jun 20, 2014 at 8:48 PM, Leonard Jacobs <<a href="mailto:ljacobs@netsecuris.com" target="_blank">ljacobs@netsecuris.com</a>> wrote:<o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>What is the difference between that and putting them in $EXTERNAL_NET with telling them to not include using a exclamation point in front of IPs?</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Brant Wells [mailto:<a href="mailto:bwells@tfc.edu" target="_blank">bwells@tfc.edu</a>] <br><b>Sent:</b> Friday, June 20, 2014 1:06 PM<br><b>To:</b> Leonard Jacobs<br><b>Cc:</b> Darien Huss; OISF Users</span><o:p></o:p></p><div><div><p class=MsoNormal><br><b>Subject:</b> Re: [Oisf-users] How do you ignore External IP Addresses?<o:p></o:p></p></div></div><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>You could also add the IP Ranges that you want to ignore to the $HOME_NET variable... <o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>$HOME_NET = [<a href="http://10.0.0.0/16" target="_blank">10.0.0.0/16</a>, <a href="http://192.168.1.0/24" target="_blank">192.168.1.0/24</a>, <a href="http://8.8.8.8/32" target="_blank">8.8.8.8/32</a>]<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Or something like that to make it ignore the servers that you don't want to monitor traffic from.<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'> <o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>On Fri, Jun 20, 2014 at 12:23 PM, Leonard Jacobs <<a href="mailto:ljacobs@netsecuris.com" target="_blank">ljacobs@netsecuris.com</a>> wrote:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I am trying to avoid customizing a standard signature because updating becomes problematic then.<o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'><br>----- Original Message -----<br>From: Darien Huss [mailto:<a href="mailto:dhuss@emergingthreats.net" target="_blank">dhuss@emergingthreats.net</a>]<br>To: Leonard Jacobs [mailto:<a href="mailto:ljacobs@netsecuris.com" target="_blank">ljacobs@netsecuris.com</a>]<br>Cc: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>Sent: Fri, 20 Jun 2014 06:59:49 -0500<br>Subject: Re: [Oisf-users] How do you ignore External IP Addresses?<br><br><br>> Without seeing the traffic I'm not sure if this would be reliable, but you<br>> could possibly add something like this to that rule if the test webpage<br>> occurs on the same domain every time:<br>><br>> content:!"<a href="http://trustedvendor.com" target="_blank">trustedvendor.com</a>"; http_header;<br>><br>> If their IP address were to change but the domain stays the same the above<br>> would still work.<br>><br>> Regards,<br>><br>> Darien<br>><br>><br>> On Fri, Jun 20, 2014 at 7:24 AM, Leonard Jacobs <<a href="mailto:ljacobs@netsecuris.com" target="_blank">ljacobs@netsecuris.com</a>><br>> wrote:<br>><br>> > I want to be able to ignore some External source IP addresses in<br>> > signatures. Can I list them in suricata.yaml with a ! in front of them.<br>> > Like:<br>> ><br>> ><br>> ><br>> > EXTERNAL_NET: "[!$HOME_NET, !x.x.x.x, !x.x.x.x/16]" for example.<br>> ><br>> ><br>> ><br>> > I have a trusted vendor that is causing false positives because they<br>> > refuse to change a numeric string in what they are sending in a test web<br>> > page so it is triggering a Trojan signature. I want to ignore their<br>> > traffic. I know that is dangerous if they were really used as an attack<br>> > vector into my network.<br>> ><br>> ><br>> ><br>> > Any suggestions?<br>> ><br>> ><br>> ><br>> > Leonard<br>> ><br>> ><br>> ><br>> ><br>> ><br>> ><br>> ><br>> > _______________________________________________<br>> > Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>> > Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>> > List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>> > OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br>> ><br>><o:p></o:p></p></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Leonard Jacobs, MBA, CISSP, CSSAPresident/CEONetsecuris Inc.P <a href="tel:952-641-1421%20ext.%2020" target="_blank">952-641-1421 ext. 20</a><a href="http://www.netsecuris.com" target="_blank">http://www.netsecuris.com</a><o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>_______________________________________________<br>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><o:p></o:p></p></div></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><br><br clear=all><o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>-- <o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-family:"Verdana","sans-serif"'>~Brant Wells</span><o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:7.5pt;font-family:"Georgia","serif"'>Network Administrator</span><o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:7.5pt;font-family:"Georgia","serif"'>Toccoa Falls College</span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:7.5pt;font-family:"Georgia","serif"'>107 Kincaid Drive Toccoa Falls, GA 30598</span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:7.5pt;font-family:"Georgia","serif"'><a href="tel:706-886-7299%20x5346" target="_blank">706-886-7299 x5346</a> * <a href="mailto:bwells@tfc.edu" target="_blank">bwells@tfc.edu</a></span><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div></div></div></div></div></div></div></div></div></div><p class=MsoNormal><br><br clear=all><o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal>-- <o:p></o:p></p><div><p class=MsoNormal><span style='font-family:"Verdana","sans-serif"'>~Brant Wells</span><o:p></o:p></p><div><p class=MsoNormal><span style='font-size:7.5pt;font-family:"Georgia","serif"'>Network Administrator</span><o:p></o:p></p><div><p class=MsoNormal><span style='font-size:7.5pt;font-family:"Georgia","serif"'>Toccoa Falls College</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:7.5pt;font-family:"Georgia","serif"'>107 Kincaid Drive Toccoa Falls, GA 30598</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:7.5pt;font-family:"Georgia","serif"'>706-886-7299 x5346 * <a href="mailto:bwells@tfc.edu" target="_blank">bwells@tfc.edu</a></span><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div></div></div></div></div></div></body></html>