<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Sorry for so many emails.<br><br>So with using pass rules (for example, pass ip 1.1.1.1 any <> any any (sid:1;) ), I would have an issue with signature id since I will have a lot of these entries for different IPs.<br>What is the best way to make these unique? If I use different SID, what range can I use so I dont overwrite ET PRO ruleset. or what would be the best approach here?<br><br>Thanks.<br><br><div>> Date: Mon, 30 Jun 2014 17:08:10 +0200<br>> From: lists@inliniac.net<br>> To: oisf-users@lists.openinfosecfoundation.org<br>> Subject: Re: [Oisf-users] Suppress all signatures per source IP<br>> <br>> On 06/30/2014 05:06 PM, Yasha Zislin wrote:<br>> > Nevermind this question. I found a better way to deal with this that<br>> > works for me.<br>> > <br>> > I will be suppressing alerts in threshold file:<br>> > suppress gen_id 0, sig_id, track by_src, ip 1.1.1.1<br>> <br>> A pass rule will perform better and will ultimately have the same<br>> effect. Any reason you cannot use it?<br>> <br>> See also<br>> https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Ignoring_Traffic<br>> <br>> Cheers,<br>> Victor<br>> <br>> > <br>> > <br>> > <br>> > ------------------------------------------------------------------------<br>> > From: coolyasha@hotmail.com<br>> > To: cnelson@ucsd.edu; oisf-users@lists.openinfosecfoundation.org<br>> > Date: Mon, 30 Jun 2014 14:51:29 +0000<br>> > Subject: Re: [Oisf-users] Suppress all signatures per source IP<br>> > <br>> > It looks like BPF filter will not work for me since I cannot afford<br>> > inspection loss during service restart.<br>> > <br>> > Is my specification of EXTERNAL_NET variable correct? It doesnt seem to<br>> > work correctly.<br>> > I have an IP 1.1.1.1 which is part of MYVAR whish should not be part of<br>> > External net.<br>> > A rule triggers:<br>> > <br>> > alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"")<br>> > <br>> > Judging from the variables config, it should not have triggered.<br>> > <br>> > Any idea?<br>> > <br>> > Thanks.<br>> > <br>> >> Date: Thu, 26 Jun 2014 14:18:14 -0700<br>> >> From: cnelson@ucsd.edu<br>> >> To: coolyasha@hotmail.com; oisf-users@lists.openinfosecfoundation.org<br>> >> Subject: Re: [Oisf-users] Suppress all signatures per source IP<br>> >><br>> > As mentioned, I really think bpf filters are the way to go here.<br>> > <br>> > For example, we filter our IP traffic from the Qualys SOC vulnerability<br>> > scanners with this expression:<br>> > <br>> > not (net 64.39.96.0/20)<br>> > <br>> > Note that bpf filters are preferable as they are extremely high<br>> >> performance.<br>> > <br>> > -Coop<br>> > <br>> > On 6/26/2014 12:48 PM, Yasha Zislin wrote:<br>> >> Hmm. Sounds like a pain to do this with pass rules.<br>> > <br>> >> So the way I've done this in the past (with Snort) was that I've created<br>> >> a custom variable with a list of IPs.<br>> >> Then I would set my external net as follows.<br>> > <br>> >> MYVAR_IP: "[1.1.1.1,2.2.2.2,3.3.3.3]"<br>> > <br>> >> EXTERNAL_NET: "[!$HOME_NET,!$MYVAR_IP]"<br>> > <br>> >> Most of the rules are configured to check from external to home. So if<br>> >> my IPs are not part of External, then this suppression occurs.<br>> >> For some reason this does not work in Suricata.<br>> > <br>> > <br>> > <br>> > <br>> > _______________________________________________ Suricata IDS Users<br>> > mailing list: oisf-users@openinfosecfoundation.org Site:<br>> > http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>> > List:<br>> > https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> > OISF: http://www.openinfosecfoundation.org/<br>> > <br>> > <br>> > _______________________________________________<br>> > Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> > Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>> > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> > OISF: http://www.openinfosecfoundation.org/<br>> > <br>> <br>> -- <br>> ---------------------------------------------<br>> Victor Julien<br>> http://www.inliniac.net/<br>> PGP: http://www.inliniac.net/victorjulien.asc<br>> ---------------------------------------------<br>> <br>> _______________________________________________<br>> Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> OISF: http://www.openinfosecfoundation.org/<br></div> </div></body>
</html>