Snort: Block False Positive from Dlink Wireless Router
 

Hi

I have a Dlink DL-624 wireless router on my network. It broadcasts the following across the network on UDP port 1900

Source Destination
192.168.1.2:1900 239.255.255.250:1900 UDP

Snort picks this up which is causing a problem as the database gets HUGE very quickly !!!

How do i get snort to ignore this traffic ??

I do not have a firewall running either so thats not really an option as yet.

Thanks in advance

Hi,
I had the same thing going on. The way I stopped it was go in on the rules "misc.rules" and changed the line for 1900 from alert to pass the first word in the line and the 1900 alarms are gone forever.
Good Luck
Rick