Snort mailing list archives
Re: preprocessor portscan-ignorehosts
From: Erek Adams <erek () snort org>
Date: Tue, 8 Jul 2003 16:36:44 -0400 (EDT)
On Sat, 5 Jul 2003, Frederick B. Henry, Jr. wrote: [...snip...]
preprocessor portscan-ignorehosts: $DNS_SERVERS 209.248.79.90/32
[...snip...]
preprocessor portscan2: scanners_max 1000, targets_max 1000, target_limit 5, port_limit 20, timeout 60 I would like to not see any scan alerts from said IP in my ACID console. What am I doing wrong?
You are using the portscan2 preprocessor and a config directive for the portscan preprocessor. Change that to portscan2-ignorehosts and you should be fine. Cheers! ----- Erek Adams "When things get weird, the weird turn pro." H.S. Thompson ------------------------------------------------------- This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing and get a free book. www.parasoft.com/bulletproofapps _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- preprocessor portscan-ignorehosts Frederick B. Henry, Jr. (Jul 08)
- Re: preprocessor portscan-ignorehosts Erek Adams (Jul 08)