<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hmm. Sounds like a pain to do this with pass rules.<br><br>So the way I've done this in the past (with Snort) was that I've created a custom variable with a list of IPs.<br>Then I would set my external net as follows.<br><br> MYVAR_IP: "[1.1.1.1,2.2.2.2,3.3.3.3]"<br><br> EXTERNAL_NET: "[!$HOME_NET,!$MYVAR_IP]"<br><br>Most of the rules are configured to check from external to home. So if my IPs are not part of External, then this suppression occurs.<br>For some reason this does not work in Suricata. <br><br><br><br><div>> Date: Thu, 26 Jun 2014 12:43:27 -0700<br>> From: cnelson@ucsd.edu<br>> To: coolyasha@hotmail.com; oisf-users@lists.openinfosecfoundation.org<br>> Subject: Re: [Oisf-users] Suppress all signatures per source IP<br>> <br>> -----BEGIN PGP SIGNED MESSAGE-----<br>> Hash: SHA1<br>> <br>> I'm almost positive that bpf filters are only processed at run-time.<br>> They are actually compiled and then run in kernel space prior to sending<br>> the packets to the suricata process.<br>> <br>> If you wanted to be able to do a live refresh you could just use pass<br>> rules, one per host or network like this:<br>> <br>> > pass ip 111.222.111.222 any -> any any (sid:1)<br>> <br>> (not sure if you even need a sid!)<br>> <br>> - -Coop<br>> <br>> On 6/26/2014 12:36 PM, Yasha Zislin wrote:<br>> > so if my filter file gets updated, would I have to restart suricata<br>> > service or rule-reload would refresh it?<br>> > <br>> > Thanks for detailed explanation.<br>> > <br>> >> Date: Thu, 26 Jun 2014 12:30:26 -0700<br>> >> From: cnelson@ucsd.edu<br>> >> To: coolyasha@hotmail.com; oisf-users@lists.openinfosecfoundation.org<br>> >> Subject: Re: [Oisf-users] Suppress all signatures per source IP<br>> >><br>> > Again, the right way to do this is via bpf filters. That way the<br>> > packets are efficiently filtered by the kernel.<br>> > <br>> > Just start suricata with 'not host 111.222.111.222' on the command line.<br>> > <br>> > If you are going to need a large list, use a filter file specified by<br>> > the -F command line argument.<br>> > <br>> > Bpf filter syntax is explained here:<br>> > <br>> >> http://biot.com/capstats/bpf.html<br>> > <br>> > -Coop<br>> > <br>> <br>> - -- <br>> Cooper Nelson<br>> Network Security Analyst<br>> UCSD ACT Security Team<br>> cnelson@ucsd.edu x41042<br>> -----BEGIN PGP SIGNATURE-----<br>> Version: GnuPG v2.0.17 (MingW32)<br>> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/<br>> <br>> iQEcBAEBAgAGBQJTrHffAAoJEKIFRYQsa8FW9m0H/2JAFxaIiYTVmJHQcaARIk1D<br>> nIG2I5Pnv2nwQvkff9mdPSma4oSZYKiSaETwpX6FInO1AnCwLWfynzkpnvd2hEWT<br>> 1Ci4T3iM0yl1dcl7dW2PPnTpSSj3gUUlI09zMUYJkvXTqKYIFOnKygCsTuD9a2Qb<br>> xPKzmaqrPCwj3pnmYnS9ZlP8SeQLxSgGIHSWwmpNDAtovVXpVlPgkKN0y3gQfDTT<br>> zq5HPJ/P536FcmADg4l9kWdeLeZ4IxE7tuQ7tSCo7BphPlJNKZ7D0degVLuqBP0v<br>> WpYablvZkbPs5CEIm5ENdXTJ4e9UDtQlZ+GlVy7++yu4uYDPOCfazqzFENIJQn0=<br>> =Djua<br>> -----END PGP SIGNATURE-----<br></div> </div></body>
</html>