Snort mailing list archives
Re: Pass rules??
From: Roberto Suarez Soto <robe () alfa21 com>
Date: Thu, 9 May 2002 10:26:30 +0200
On May/07, R. Janaki wrote:
We are using Snort1.8.3 with mysql and demarc.We need to ignore some packets based on their ips,ie.,write some pass rules.Where do you place these rules and how do you configure snort for the same.Could somebody help us out.
There's a "local-first" and "local-last" files in /etc/snort (at least in Linux; I suppose it's the same for every other Unix). Those are what I use for pass rules and similar things. -- Roberto Suarez Soto Alfa21 Outsourcing robe () alfa21 com http://www.alfa21.com _______________________________________________________________ Have big pipes? SourceForge.net is looking for download mirrors. We supply the hardware. You get the recognition. Email Us: bandwidth () sourceforge net _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Pass rules?? R . Janaki (May 07)
- Re: Pass rules?? Roberto Suarez Soto (May 09)