Re: Portscan2...

[Shawn Duffy <pakkit () codepiranha org>]

On Sat, 2003-03-22 at 11:54, Tobias Rice wrote:
> So, how do I prevent this? I tried this:
> preprocessor portscan2-ignorehosts: 111.222.333.444
> and now I don't get any alerts when I'm portscanned.

Don't know why you wouldn't be getting any alerts without seeing your
snort.conf, but to exclude your IP try:
111.222.333.444/32

Shawn
-- 
email: pakkit at codepiranha dot org
web: http://codepiranha.org/~pakkit
gpg key: http://codepiranha.org/~pakkit/pakkit.asc
gpg fpr: 8988 6FB6 3CFE FE6D 548E  98FB CCE9 6CA9 98FC 665A
having problems reading email from me?
http://codepiranha.org/~pakkit/pgp-trouble.html

Attachment: signature.asc
Description: This is a digitally signed message part