Re: portscan preprocessor and external net

[marco turr <marco_syslnx () yahoo it>]

Matt Kettler <mkettler () evi-inc com> ha scritto:
 Generally speaking, you want to do the opposite. You want to ignore your subnet,
and no others.


 We need to detect only home hosts that make portscan to any (compromised hosts) because we have a lot of scanning from 
external.
 Now, i must subnet all internet address? There is no way to make a !$HOME_NET without writing ALL internet address?


                
---------------------------------
Yahoo! Messenger: chiamate gratuite in tutto il mondo