Re: [RGSPAM] exclude ip

["Al McGale" <al.mcgale () gmail com>]

I've looked over the user guide, but I'm obviously not looking in the right
spot.  In my environment there are some sensors that will see traffic from
multiple scanning stations.  I've been adding the scanners to the
threshold.conf one by one for each rule they hit, but I would much prefer to
eliminate the scanner's IP addresses completely for all rules.

Can someone point me in the right direction on this?

On 7/7/06, Lee Clemens <snort () leeclemens net> wrote:
> If you want to exclude it for one rule (or a few), just put it in
> threshold.conf. Check out the user's guide for syntax...
>
> -----Original Message-----
> From: snort-users-bounces () lists sourceforge net
> [mailto:snort-users-bounces () lists sourceforge net] On Behalf Of Joel Esler
> Sent: Friday, July 07, 2006 8:05 AM
> To: fname lname
> Cc: snort-users () lists sourceforge net
> Subject: Re: [Snort-users] [RGSPAM] exclude ip
>
> Can you place it in 'EXTERNAL_NET'?
>
> J
>
> On Wed, Jul 05, 2006 at 05:08:45PM -0400, fname lname sent me:
> > If I wanted to exclude an ip from the ids how will i go about doing
> that.
> > Ex is I wanted to exclude 1.2.3.4 from an smtp rule how can i make that
> > happen?
>
> > Using Tomcat but need to do more? Need to support web services,
> security?
> > Get stuff done quickly with pre-integrated technology to make your job
> easier
> > Download IBM WebSphere Application Server v.1.0.1 based on Apache
> Geronimo
> > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
>
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> +---------------------------------------------------------------------+
> Joel Esler          Senior Security Consultant         1-706-627-2101
> Sourcefire    Security for the /Real/ World -- http://www.sourcefire.com
> Snort - Open Source Network IPS/IDS -- http://www.snort.org
> GPG Key http://demo.sourcefire.com/jesler.pgp.key
> +---------------------------------------------------------------------+
>
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users