Re: Snort + BB: Ignore BB Activity

[Dushyanth Harinath <dushy () symonds net>]

Hi , 

 * <Joseph.Warner () siemens com> wrote from a remote bunker :
 
> Everything seems to work properly with the exception
> of the BB server's activity showing up as spp_portscans
> in my snort logs.  How do I get this to stop?

use the portscan-ignorehosts preprocessor.

put 'preprocessor portscan-ignorehosts: $IP' into your snort.conf.
Replace $IP with your BB server's IP and then restart snort.

HTH
dushyanth
-- 
The Definition of an Upgrade: Take old bugs out, put new ones in.

http://symonds.net/~dushy


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users