Snort mailing list archives

Exclude hosts in snort


From: "Jason" <netlist () kua net>
Date: Mon, 11 Aug 2003 12:01:25 -0400

I have searched the posts and web and can't seem to find an easy/working way to exclude host from snort. I have 
thousands of alert from multiple servers on my network. I am trying to find a way to tell snort "globally" not to pay 
attention to these hosts. I would like to be able to add this to the snort.conf file so I can copy this file to my 
other sensors. I have used the command line "not host" options which does work but I have way to many hosts to use 
that. I don't want to edit every rule file. Basically I want to be able to add a host to one location, restart snort 
and be done with it. any help is appreciated, thanks

Jason


P.S. I'm running redhat 8

Current thread: