RE: Ignoring all traffic from a certain network

["Wirth, Jeff" <WirthJe () DNB com>]

Stephen,

> Is there a way to have Snort and all of it's rules ignore all 
> traffic from 
> a specific /24?  Like a global portscan-ignorehosts directive 
> that affects 
> everything, not just port scans?  I get a lot of false 
> positives in the 
> rules from my HOME_NET that I'd like to take out, if 
> possible... thanks 
> everyone.

You might try...

<snort.conf>
var EXTERNAL_NET = !HOME_NET

or

<snort command line w/ BPF filter>
snort <options> not src net X.X.X.X             # see snort man page for
more info..


- Jeff



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users