Suppressing Rules

Problem

You want to suppress a rule without permanently removing it from the ruleset.

Solution

Use the suppress command to suppress a rule.

suppress gen_id , sid_id

Discussion

Suppression allows you to deactivate a rule completely. The options are gen_id and sig_id. Gen_id is the generator ID, and sig_id is the Snort signature ID.

To suppress an event entirely:

suppress gen_id 1, sig_id 1234

See Also

Snort User Manual

Recipe 3.17