Snort mailing list archives
Re: [RGSPAM] Re: [RGSPAM] exclude ip
From: Martin Roesch <roesch () sourcefire com>
Date: Mon, 10 Jul 2006 10:28:13 -0400
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Use a BPF filter. When you start Snort, add in a filter at the command line (or put it in a file and use the -F <filterfile> switch at the command line). For example: snort -c snort.conf not host 1.2.3.4 Try that. -Marty On Jul 10, 2006, at 10:07 AM, Al McGale wrote:
I've looked over the user guide, but I'm obviously not looking in the right spot. In my environment there are some sensors that will see traffic from multiple scanning stations. I've been adding the scanners to the threshold.conf one by one for each rule they hit, but I would much prefer to eliminate the scanner's IP addresses completely for all rules. Can someone point me in the right direction on this? On 7/7/06, Lee Clemens <snort () leeclemens net> wrote: If you want to exclude it for one rule (or a few), just put it in threshold.conf. Check out the user's guide for syntax... -----Original Message----- From: snort-users-bounces () lists sourceforge net [mailto:snort-users-bounces () lists sourceforge net ] On Behalf Of Joel Esler Sent: Friday, July 07, 2006 8:05 AM To: fname lname Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] [RGSPAM] exclude ip Can you place it in 'EXTERNAL_NET'? J On Wed, Jul 05, 2006 at 05:08:45PM -0400, fname lname sent me:If I wanted to exclude an ip from the ids how will i go aboutdoing that.Ex is I wanted to exclude 1.2.3.4 from an smtp rule how can imake thathappen?Using Tomcat but need to do more? Need to support web services,security?Get stuff done quickly with pre-integrated technology to makeyour job easierDownload IBM WebSphere Application Server v.1.0.1 based on ApacheGeronimohttp://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users+--------------------------------------------------------------------- + Joel Esler Senior Security Consultant 1-706-627-2101 Sourcefire Security for the /Real/ World -- http:// www.sourcefire.com Snort - Open Source Network IPS/IDS -- http://www.snort.org GPG Key http://demo.sourcefire.com/jesler.pgp.key +--------------------------------------------------------------------- + Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel? cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel? cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ---------------------------------------------------------------------- --- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel? cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
- -- Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616 Sourcefire - Security for the Real World - http://www.sourcefire.com Snort: Open Source IDP - http://www.snort.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (Darwin) iD8DBQFEsmP9qj0FAQQ3KOARAje+AJwPbSyJxeguXE6KuUbljmNY5YSDAACcDJc5 yL4+GmRFzYkC9hZveNYG6+8= =7heJ -----END PGP SIGNATURE----- ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- exclude ip fname lname (Jul 05)
- Re: [RGSPAM] exclude ip Joel Esler (Jul 07)
- Re: [RGSPAM] exclude ip Lee Clemens (Jul 07)
- Re: [RGSPAM] exclude ip Al McGale (Jul 10)
- Re: [RGSPAM] Re: [RGSPAM] exclude ip Martin Roesch (Jul 10)
- Re: [RGSPAM] Re: [RGSPAM] exclude ip Jason Brvenik (Jul 10)
- Re: [RGSPAM] exclude ip Paul Halliday (Jul 10)
- Re: [RGSPAM] exclude ip Lee Clemens (Jul 07)
- Re: [RGSPAM] exclude ip Joel Esler (Jul 07)
- <Possible follow-ups>
- Re: exclude ip Michael Scheidell (Jul 06)
- Re: exclude ip Gustavo Monteiro (Jul 06)