portscan2-ignoreports...anyone get it to work???

["Jeff Oliveto" <joliveto () CleanCommunications com>]

Has anyone confirmed that the "preprocessor portscan2-ignoreports: s1 s2
d1 d2" variable works?  
 
I'm running snort v 1.9.1, and varified that the feature is in the
spp_portscan2.c source.
 
No matter how I specify the variable in the snort.conf file I can't get
portscan2 to filter on the source or destination ports.  Tried several
different variations and none seem to have an affect (see examples
below).  BTW...the portscan2-ignorehosts variable does work in filtering
on the source address.
 
If it does work...what is the trick?
 
======== examples ===============
 
Preferred configuration:
 
preprocessor portscan2-ignorehosts: $HOME_NET
preprocessor portscan2-ignoreports: s53 s80 s443 d53 d80 d443
preprocessor portscan2: scanners_max 3200, targets_max 5000,
target_limit 5, port_limit 20, timeout 60
 
Alternate variations used during troubleshooting....
 
Removed ignorehosts and filter just on source/destination port...doesn't
work:
 
#preprocessor portscan2-ignorehosts: $HOME_NET
preprocessor portscan2-ignoreports: s53 s80 s443 d53 d80 d443
preprocessor portscan2: scanners_max 3200, targets_max 5000,
target_limit 5, port_limit 20, timeout 60
 
Reduce to one source port...doesn't work:
 
preprocessor portscan2-ignorehosts: $HOME_NET
preprocessor portscan2-ignoreports: s80
preprocessor portscan2: scanners_max 3200, targets_max 5000,
target_limit 5, port_limit 20, timeout 60
 
Change position...doesn't work:
 
preprocessor portscan2-ignorehosts: $HOME_NET
preprocessor portscan2: scanners_max 3200, targets_max 5000,
target_limit 5, port_limit 20, timeout 60
preprocessor portscan2-ignoreports: s53 s80 s443 d53 d80 d443

Jeff Oliveto