Block Sender (not Recipient) for just 1 or more Rule(s) in SNORT?
-
Is there a way to set 1 Alert/Block Rule to block only the Sender - without setting the Global IDS setting. We have a couple of rules that we'd like to block the Sender IP on, but not the Recipient - while for most/all of them, we want to block both; is there a method to do this? Any input is appreciated!
-
@TMC1 said in Block Sender (not Recipient) for just 1 or more Rule(s) in SNORT?:
Is there a way to set 1 Alert/Block Rule to block only the Sender - without setting the Global IDS setting. We have a couple of rules that we'd like to block the Sender IP on, but not the Recipient - while for most/all of them, we want to block both; is there a method to do this? Any input is appreciated!
No, the blocking is not that granular. The setting for which IP to block (SRC, DST or BOTH) is global.
Depending on exactly what you are wanting to do, you could perhaps create one or two custom rules that only trigger for that one Sender IP you wish to block. But that also is dependent on exactly what traffic you want to trigger on.
