Re: Portscan preprocessor catching DNS replies

[Jörgen Persson <jpn () tlth lth se>]

On Wed, Aug 15, 2001 at 03:42:44PM -0400, Mathieu Nantel wrote:
[snip]
> My DNS server, like any other, recursively asks the root servers, than
> the target domain's dns servers, and so on... What I would like to do
> is, as an example, ignore anything UDP from port 53 to any over 1024.
[snip]

I used to have the same problem and I couldn't find a way to solve it
with ''portscan-ignorehosts''. There might be a way to solve it with a
snort rule but I made an ugly bpf hack.

% cat /etc/snort/bpf.rules
not udp src port domain
% snort -F /etc/snort/bpf.rules

Jörgen

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users