Snort mailing list archives
Ignore hosts
From: "Dominic" <dominic () multilink co za>
Date: Sat, 5 Mar 2005 12:56:28 +0200
Hi all, I am running Snort on a pc that also uses ADSL. I am seeing a lot of alerts generated from my ADSL host and want to ignore these alerts. I have added "ignore_scanners { $ppp0_ADDRESS }" to my sfportscan config - my problem is that this works for the current ip, but whenever the ADSL gets it's new ip, I see alerts from the ADSL host again. I then have to restart snort to use the new ip address. Does anyone know a way around this? Thanks, Dominic.
Current thread:
- Ignore hosts Dominic (Mar 05)