Snort mailing list archives
Re: suppress 'open port' on well-known services
From: Jeremy Hewlett <jh () sourcefire com>
Date: Wed, 23 Feb 2005 15:55:16 -0500
On Wed, Feb 23, Roy Kidder wrote:
Can I write suppression statements based not only on gen_id, sig_id, and src/dst ip, but also include tcp or udp port? Or am I approaching this the wrong way?
Currently a user can only ignore by Scanned host or by Scanning host with sfPortscan. The optimal way to do this would be to add ignores for port+IP. This is currently under development/testing - hoping to get this out soon. ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- suppress 'open port' on well-known services Roy Kidder (Feb 23)
- Re: suppress 'open port' on well-known services Jeremy Hewlett (Feb 23)