Snort mailing list archives
Exclude hosts in snort
From: "Jason" <netlist () kua net>
Date: Mon, 11 Aug 2003 12:01:25 -0400
I have searched the posts and web and can't seem to find an easy/working way to exclude host from snort. I have thousands of alert from multiple servers on my network. I am trying to find a way to tell snort "globally" not to pay attention to these hosts. I would like to be able to add this to the snort.conf file so I can copy this file to my other sensors. I have used the command line "not host" options which does work but I have way to many hosts to use that. I don't want to edit every rule file. Basically I want to be able to add a host to one location, restart snort and be done with it. any help is appreciated, thanks Jason P.S. I'm running redhat 8
Current thread:
- Exclude hosts in snort Jason (Aug 11)
- Re: Exclude hosts in snort Erek Adams (Aug 11)
- Re: Exclude hosts in snort Bryan Irvine (Aug 11)
- Re: Exclude hosts in snort Erek Adams (Aug 11)
- Re: Exclude hosts in snort Bryan Irvine (Aug 11)
- Re: Exclude hosts in snort Erek Adams (Aug 11)
- <Possible follow-ups>
- Re: Exclude hosts in snort JP Vossen (Aug 11)
- RE: Exclude hosts in snort Schmehl, Paul L (Aug 11)
- Exclude hosts in snort Jason Smalley (Aug 12)