How do i suppress this rule

[NightHawk007]

(http_inspect) NO CONTENT-LENGTH OR TRANSFER-ENCODING IN HTTP RESPONSE lastest version of snort i updated today .

[RonpfS]

http://forum.pfsense.org/index.php/topic,41533.msg220902.html#msg220902

[ipv6kid]

BUMP

This rule is not being suppressed even though I believe I have everything correctly written in SNORT > Suppress:
suppress gen_id 120, sig_id 3

I've restarted Snort and also restarted the entire PFsense router and SNORT 2.0 is still throwing alerts for this SID.

What's the issue?

[ipv6kid]

I am getting the following SNORT startup message in system.log:

Nov 12 16:29:45 www snort[1955]: +–---------------------[suppression]–----------------------------------------
Nov 12 16:29:45 www snort[1955]: +–---------------------[suppression]–----------------------------------------
Nov 12 16:29:45 www snort[1955]: | none
Nov 12 16:29:45 www snort[1955]: | none
Nov 12 16:29:45 www snort[1955]: –-----------------------------------------------------------------------------
Nov 12 16:29:45 www snort[1955]: –-----------------------------------------------------------------------------

It seems that my suppression rule isn't being activated somehow…...

[Cino]

after you created the list, did you select that list under the interface config page?

[ipv6kid]

No I did not, and that seemed to be the problem. Didn't know I had to do that… thanks girlfriend!
@Cino:

after you created the list, did you select that list under the interface config page?

[NightHawk007]

@Cino:

after you created the list, did you select that list under the interface config page?

Where is this page located i can't seem to find it .With problem i can't search the internet at all i keep getting the rule blocked .

[RonpfS]

Uncheck Block offenders until you fix the suppress rule and still have internet access.

It is under Snort: Interface Edit: (If settings) Suppression and filtering

[cdx304]

@RonpfS:

Uncheck Block offenders until you fix the suppress rule and still have internet access.

It is under Snort: Interface Edit: (If settings) Suppression and filtering

I just have snort turned off .Tried to suppress rule and nothing works

[RonpfS]

Did you remove your WAN IP from the Blocked list?

[cdx304]

@RonpfS:

Did you remove your WAN IP from the Blocked list?

MY ip was never blocked

[dwood]

In the "for what it's worth category" this message, and my need to suppress it (amd64 V2.0), disappeared with an uninstall of SNORT and reinstall with the updated 2.9.1 package.

Previous to that, everything was being blocked and the event log was being flooded with HTTP_INSPECT events.

[RonpfS]

2011-11-12 00:05:24	Daemon.Notice	x.x.x.x	snort[33078]: | gen-id=120    sig-id=3          type=Suppress  tracking=none filtered=109

I still get them  :-[

[ipv6kid]

Youtube Video