Snort mailing list archives
RE: Not ignoring DNS servers
From: "Snoopy" <wayne () cybergnostic com>
Date: Thu, 6 Sep 2001 14:15:32 -0400
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dudes, I have the same problems somewhat. I have even put the IPs in the preprocessor line instead of the $DNS_SERVER variable. Actually I have tried both ways. I am running the Windows port of snort on a win2k box. The error is MISC source port 53 to < 1024 10.X.X.X 10.Y.Y.Y UDP. We are running What's Up as a SNMP trap monitor as well as some service monitoring. Wayne - -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net]On Behalf Of Paul Slinski Sent: Thursday, September 06, 2001 1:50 PM To: snort-users () lists sourceforge net Subject: [Snort-users] Not ignoring DNS servers I have snort set up the following way in snort.conf (snort rules from snort site): var DNS_SERVERS [206.191.0.140/32,206.191.0.210/32] and preprocessor portscan-ignorehosts: $DNS_SERVERS Yet snort still reports: [**] [1:0:0] ICMP Destination Unreachable (Port Unreachable) [**] 09/06-00:02:01.200180 206.191.19.2 -> 206.191.0.210 ICMP TTL:255 TOS:0xC0 ID:51451 IpLen:20 DgmLen:141 Type:3 Code:3 DESTINATION UNREACHABLE: PORT UNREACHABLE ** ORIGINAL DATAGRAM DUMP: 206.191.0.210:53 -> 206.191.19.2:4611 UDP TTL:253 TOS:0x0 ID:13975 IpLen:20 DgmLen:113 Len: 93 ** END OF DUMP Any ideas? - -Paul _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBO5e9Qn+SpcqzAmBdEQLbdgCfdO569VOJkZzBs0mA57Dku1yMpkEAnilw dBmvKwf3sBMooncNedLCW5jP =lNYD -----END PGP SIGNATURE----- _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Not ignoring DNS servers Paul Slinski (Sep 06)
- RE: Not ignoring DNS servers Snoopy (Sep 06)
- RE: Not ignoring DNS servers Paul Slinski (Sep 06)
- Re: Not ignoring DNS servers Italo Antonio (Sep 06)
- <Possible follow-ups>
- RE: Not ignoring DNS servers Paul Slinski (Sep 06)
- RE: Not ignoring DNS servers Snoopy (Sep 06)