Re: Exclude hosts in snort

[Erek Adams <erek () snort org>]

On Mon, 11 Aug 2003, Jason wrote:

> I have searched the posts and web and can't seem to find an easy/working
> way to exclude host from snort. I have thousands of alert from multiple
> servers on my network. I am trying to find a way to tell snort
> "globally" not to pay attention to these hosts. I would like to be able
> to add this to the snort.conf file so I can copy this file to my other
> sensors. I have used the command line "not host" options which does work
> but I have way to many hosts to use that. I don't want to edit every
> rule file. Basically I want to be able to add a host to one location,
> restart snort and be done with it. any help is appreciated, thanks

http://www.theadamsfamily.net/~erek/snort/ignore.txt

And FAQ 3.9 http://www.snort.org/docs/FAQ.txt

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users