Thresholds tab in snort - suppress not stopping alerts

[chowtamah]

Hai, I am having following configuration,
PFsense Ver: 1.2.3-RELEASE
Snort:  Snort 2.8.5.3 pkg v. 1.24

In Suppress Tab, I added following entries

suppress gen_id 119, sig_id 2
suppress gen_id 119, sig_id 4
suppress gen_id 119, sig_id 13
suppress gen_id 119, sig_id 14

and restarted the snort, but still alert is generated and related ip (computer) gets blocked.

Earlier V.1.22, i added these to threshold.conf of each interface and it worked.
Should I do the same in this snort package version also?

[jamesdean]

@chowtamah:

Hai, I am having following configuration,
PFsense Ver: 1.2.3-RELEASE
Snort:  Snort 2.8.5.3 pkg v. 1.24

In Suppress Tab, I added following entries

suppress gen_id 119, sig_id 2
suppress gen_id 119, sig_id 4
suppress gen_id 119, sig_id 13
suppress gen_id 119, sig_id 14

and restarted the snort, but still alert is generated and related ip (computer) gets blocked.

Earlier V.1.22, i added these to threshold.conf of each interface and it worked.
Should I do the same in this snort package version also?

Make sure you select the suppress list at the interface edit tab.

James

[chowtamah]

Thanks James,

I am sorry to disturbing you. It is my fault to raise the question without studying the interface.

I selected the suppression file in interface tab (IF settings) and now it works fine.

Thank you once again.

[Davc]

James,

It seems these 2 suppress rules cannot supress. I am still getting alert and block on these:

suppress gen_id 119, sig_id 4
suppress gen_id 119, sig_id 14

Davc

[jamesdean]

@Davc:

James,

It seems these 2 suppress rules cannot suppress. I am still getting alert and block on these:

suppress gen_id 119, sig_id 4
suppress gen_id 119, sig_id 14

Davc

suppress gen_id 119, sig_id 4    http_inspect: BARE BYTE UNICODE ENCODING

I think thats a flash false positive.

Make sure you restart snort after you have these settings entered.

James

[g4m3c4ck]

Wow I feel like an idiot that I did not see that before. I guess I believed the drop down menus only had Default like my Home Net and external net has and ignored the rest while completely ignoring the fine text which is quite small on my laptop…. duuurr