Snort mailing list archives
Re: Portscan does not ignore my net
From: Erek Adams <erek () snort org>
Date: Tue, 18 Mar 2003 01:24:29 -0500 (EST)
On Mon, 17 Mar 2003, Smith, Aron wrote:
I have an ignore rule for 10.28/16 and the -o option specified. Initially it worked, but after clearing out the database of old alerts, snort is ignoring my ignore rule again and I have thousands of portscan events that are actually legit traffic.
Ummm... Pass rules only work with other rules. If it's coming from portscan or portscan2, then it's a preprocessor. It can't be ignored from a pass rule. You'll need to use a BPF filter. snort <whatever options> 'not net 10.28.0.0/16' That should do it. Cheers! ----- Erek Adams "When things get weird, the weird turn pro." H.S. Thompson ------------------------------------------------------- This SF.net email is sponsored by:Crypto Challenge is now open! Get cracking and register here for some mind boggling fun and the chance of winning an Apple iPod: http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Portscan does not ignore my net Smith, Aron (Mar 17)
- Re: Portscan does not ignore my net Erek Adams (Mar 17)