Tuning Signature 3030

[ddinh]

Hello Everyone,

I know this is only an "informational" Sig but it has helped me locate chatty worms, et al chattiness.

I want to reconfigure this signature to ignor outbound port 80. There are just too many ads and banner ads server on the internet (which is causing this signature to produce quite a bit of FP) to filter.

Thanks for your help.

Damien

[shannong]

You cannot change the behavior of this signature in that manner because it is "built-in". Instead, you can disable it, create your own, and not look at port 80.

[dpatkins]

And how does one "not look" at a port?

Thanks