Re: ignorehost for portscan2

[snort () auscert org au]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Greetings,

> Hello.
>
> I'v got a lot of false alarms from portscan2 for my proxy server (hundreds).
> Looks like 'preprocessor portscan-ignorehosts' doesn't work for portscan2?
> Is this a way to ignore this host for portscan2 or set some filter for it?

Have a go using 'preprocessor portscan2-ignorehosts'



- -- Matthew McGlashan --
Australian Computer Emergency Response Team | Hotline: +61 7 3365 4417
(AusCERT)                                   | Fax:     +61 7 3365 7031
The University of Queensland                | WWW:     www.auscert.org.au
Qld 4072 Australia                          | Email:   auscert () auscert org au
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (FreeBSD)
Comment: Exmh version 2.6.1 02/18/2003

iQCVAwUBPn5cKCh9+71yA2DNAQJXggQAmydcul+KRwXS+vPFWqfqY4bf2rljVs41
b9iI8tQSKBR8nW18JVc23BdGbmssWeR+yD/44PDOhwUX8TVeV9hoFDZ+gVJ0SZtF
xaNGsLswy2t0xt0Ne+COR4JI/jtLx+TtpAjBJdtgclV0FVexv0Fw7IEGR1NwCgTE
C3WRWVCIvT0=
=4frJ
-----END PGP SIGNATURE-----



-------------------------------------------------------
This SF.net email is sponsored by:Crypto Challenge is now open! 
Get cracking and register here for some mind boggling fun and 
the chance of winning an Apple iPod:
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users