spp

[niko () digitalenigma com]

  I am still getting bombarded with spp_portscan messages even though the
IP that I am getting the portscan from is in my $DNS_SERVERs var

Here is a modified snippet:


var DNS_SERVERS [xxx.xx.0.3,xxx.xx.0.2]


  The .0.2 is the one I am still receiving.  Any ideas??


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users