Snort and IPlist alerts

[peppegate]

Hello,
i need your support for understand if its possible and how to remove alert generated by spp_reputations .
just like :
or more important the packet whitelisted.

this generate a lot of useless Spam on the alert center (and a lot of useless email from my log system as well).

somebody know how can i remove the spp alert from snort?
tnx for your help.

[peppegate]

nobody know the answer?

[fsansfil]

Its a good question basically you want to add a noalert into the IP preprocessor rule. Something you could ask the Snort mailing list; is it possible to drop with a no alert with the IP preprocessor?

Also, pfblocker might be the solution, leave the packet payload inspection to your IDS, and all ports or IP blocking to the firewall, PF… This is what I do.

F.