Re: No clue?

[Joel Esler <joel.esler () sourcefire com>]

Because you have to include it in the line prior..  See how the lines  
prior to that have "\"?  You have to put the "\" in the line prior to  
the ignore_scanners line if you want it included..

J



On Nov 15, 2005, at 3:14 PM, John Friedman wrote:

> Thank you for your help.  Here is the config in my
> snort.conf
>
> preprocessor sfportscan: proto  { all } \
>                          memcap { 10000000 } \
>                          sense_level { low }
> ignore_scanners { 10.1.10.6 }
>
> But, If I add ignore_scanners { 10.1.10.6 } to the
> snort.conf, the snort service can not be started.  If
> I remove ignore_scanners { 10.1.10.6 }, then the snort
> service is started fine.  No idea why?
>
> Thanks,
>
> John
>
>
> --- Joel Esler <joel.esler () sourcefire com> wrote:
>
> > You need to put them into the sfportscan
> > preprocessor as either
> > ignore_scanned or ignore_scanner if you want to tune
> > the portscan
> > preprocessor.
> >
> > Joel Esler
> >
> >
> >
> > On Nov 15, 2005, at 11:27 AM, John Friedman wrote:
> >
> > > I constantly get these alerts from the citrix
> > server:
> > >  ID   < Signature >   < Timestamp >   < Source
> > Address
> > > >   < Dest. Address >   < Layer 4 Proto >
> > >             #600-(2-7409)        [snort]
> > spp_portscan
> > > from 10.1.10.6: 1 connections across 1 hosts:
> > TCP(1),
> > > UDP(0)        2005-11-15 09:49:12        10.1.10.6
> > >    unknown        IP
> > >             #601-(2-7410)        [snort]
> > spp_portscan
> > > from 10.1.10.6: 1 connections across 1 hosts:
> > TCP(1),
> > > UDP(0)        2005-11-15 09:49:19        10.1.10.6
> > >    unknown        IP
> > >             #602-(2-7411)        [snort]
> > spp_portscan
> > > from 10.1.10.6: 1 connections across 1 hosts:
> > TCP(1),
> > > UDP(0)        2005-11-15 09:49:59        10.1.10.6
> > >    unknown        IP
> > > *********
> > > I use these
> > > suppress gen_id 100, sig_id 1
> > > suppress gen_id 100, sig_id 2
> > > suppress gen_id 100, sig_id 3
> > > but it does not work.
> > >
> > > Any idea?
> > >
> > > Thanks,
> > >
> > > John
> > >
> > >
> > > --- Jeruvy <jeruvy () shaw ca> wrote:
> > >
> > > > Sorry about that, I routinely delete emails from
> > > > @yahoo.com due to spam.
> > > >
> > > > What is the alert SID?  Do you use oinkmaster?
> > > >
> > > > J.
> > > > j e r u v y a t s h a w d o t c a
> > > >
> > > >
> > > > > -----Original Message-----
> > > > > From: John Friedman
> > [mailto:jfriedmanx () yahoo com]
> > > > > Sent: Tuesday, November 15, 2005 8:45 AM
> > > > > To: snort
> > > > > Subject: RE: [Snort-users] No clue?
> > > > >
> > > > > Hi all,
> > > > >
> > > > > Since I did not get any reply on this, is there
> > > > any way to
> > > > > suppress or pass this alert?
> > > > >
> > > > > Thanks,
> > > > >
> > > > > John
> > > > >
> > > > > John Friedman <jfriedmanx () yahoo com> wrote:
> > > > >
> > > > >         Thanks for your pointing out.  Here is the info
> > > > again:
> > > > >           ID      <
> > >
> > >
> > >
> > >                 
> > > __________________________________
> > > Yahoo! FareChase: Search multiple travel sites in
> > one click.
> > > http://farechase.yahoo.com
> -------------------------------------------------------
> > > This SF.Net email is sponsored by the JBoss Inc.
> > Get Certified Today
> > > Register for a JBoss Training Course.  Free
> > Certification Exam
> > > for All Training Attendees Through End of 2005.
> > For more info visit:
> > >
> http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users () lists sourceforge net
> > > Go to this URL to change user options or
> > unsubscribe:
> > >
> https://lists.sourceforge.net/lists/listinfo/snort-users
> > > Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > >
>
>
>
>         
>                 
> __________________________________
> Yahoo! Mail - PC Magazine Editors' Choice 2005
> http://mail.yahoo.com



-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
Register for a JBoss Training Course.  Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users