Portscan: ignoreports option

[Andy Leigh <andy.leigh () bbc co uk>]

Folks,

You can put a list into portscan_ignorehosts, but what would be very handy
would be to have an option "portscan_ignoreports". In a large infrastructure
with a lot of clients waking up and trying to find NetBIOS shares and BDCs,
there's a lot of portscan noise all on the 138 and 139 ports. 

Is there an option or tweak I'm missing?

Andy Leigh


This e-mail (and any attachments) is confidential and may contain personal
views which are not the views of the BBC unless specifically stated.
If you have received it in error, please delete it from your system, do not use,
copy or disclose the information in any way nor act in reliance on it and notify
the sender immediately. Please note that the BBC monitors e-mails sent
or received. Further communication will signify your consent to this.


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users