I need to allow certain traffic through which is being blocked by snort eg ICMP from a specific address. How can I do this?
There are primarily two ways to do this
This is a very simple rule that will ignore any IP traffic with a source address of '10.10.8.200' with any source port going to any address on any destination port.
For standard "alert" rules the gen_id is always 1, the SID we want to ignore is 13948, and the host that's performing all of these lookups is '10.10.8.240'.
Similar to the IP based rule above, this should ignore any ICMP traffic that comes from '10.10.8.200', no matter who the destination is.
These rules can, of course, get more complicated, but you'll want to read some more documentation on the specifics. Your best bet is to just do a few google searches and chunk through them, but useful documentation that I've found is (in no particular order):
Great info, what if I just want to suppress a single port?
I want to do something like
with 925 being my internal port for smtp. Emails going through the smtp dump out a load of alerts I don't need to see.
Could that work with the port on the end?