Snort mailing list archives
RE: portscan2 ignore destination
From: Erek Adams <erek () snort org>
Date: Tue, 18 Mar 2003 07:47:07 -0500 (EST)
On Tue, 18 Mar 2003, Lund, Carl Fredrik wrote:
I use portscan2-ignorehosts, but that does just ignore the source addresses. Any other suggestions?
Sorry, that will ignore whatever hosts you put in that list. Source, Destination, whatever. If you can't make it work, you can use a BPF filter. snort <options> 'not host <foo> and not host <foo2>' Cheers! ----- Erek Adams "When things get weird, the weird turn pro." H.S. Thompson ------------------------------------------------------- This SF.net email is sponsored by: Does your code think in ink? You could win a Tablet PC. Get a free Tablet PC hat just for playing. What are you waiting for? http://ads.sourceforge.net/cgi-bin/redirect.pl?micr5043en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- portscan2 ignore destination Lund, Carl Fredrik (Mar 18)
- Re: portscan2 ignore destination Erek Adams (Mar 18)
- <Possible follow-ups>
- RE: portscan2 ignore destination Lund, Carl Fredrik (Mar 18)
- RE: portscan2 ignore destination Erek Adams (Mar 18)