Re: excluding a host from rule

["Alex Pinheiro Machado Rodrigues" <alex () bsbnet com>]

Example: snort -dev -c snort.conf  not host 192.168.200.3

Alex
Brazil


  ----- Original Message ----- 
  From: Chang, Andre 
  To: 'snort-users () lists sourceforge net' 
  Sent: Thursday, May 30, 2002 6:19 PM
  Subject: [Snort-users] excluding a host from rule


  Can you exclude specific hosts from triggering the alert in a rule?  But still get alerted by that rule if any other 
hosts try the same action.

  Example you have a port scan on your network and you do not want to get alerted by that host doing the scan but you 
do want to get alerted by anyone else performing a port scan.