snort rules: drop ping scans from host to subnet

[Blaqb0x]

HI,

I have a ping server that creates all these logs in snort. I'd like to drop any alerts that the ping server generates. I'm using this rule but, it doesn't work. What am I doing wrong?

pass icmp 128.111.15.4/32 any -> 128.111.15.0/24 any


Thanks,

[tolstoy]

Haven't worked with snort for a while, but can't you just negate the ip addy of the server in the rule causing the alert, like !MY_SERVER_IP? or something like that?