Snort mailing list archives
Re: exclusion
From: Wes Young <wcyoung () buffalo edu>
Date: Thu, 23 Dec 2004 13:03:28 -0500
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 have you tired the berkly packet filter rules?? config filter: not ip .... in teh snort.conf (or barnyard.conf) Jimmy Hayes wrote: | Hello I have a server that I want to exclude the alerts from happening. | In this case it's port 80. | I know I can exclude IP's and ports from rules. But I want to be able to | exclude all rules for a server on | Port 80. | | Any ideas? | | I tried preprocessor portscan-ignorehosts: x.x.x.x/32 80, but seems like | that doesn't do it. | | Thanks in advance. | | | | ------------------------------------------------------- | SF email is sponsored by - The IT Product Guide | Read honest & candid reviews on hundreds of IT Products from real users. | Discover which products truly live up to the hype. Start reading now. | http://productguide.itmanagersjournal.com/ | _______________________________________________ | Snort-users mailing list | Snort-users () lists sourceforge net | Go to this URL to change user options or unsubscribe: | https://lists.sourceforge.net/lists/listinfo/snort-users | Snort-users list archive: | http://www.geocrawler.com/redir-sf.php3?list=ort-users | | - -- Wes Young Network Security Analyst University at Buffalo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (MingW32) iD8DBQFBywhwzLe0Tk6uDXYRAjOqAKCR1OLACOhlStOh+MVaIQZ/aM1G/gCeNFhi zw95yNY6SvLA2B4qO0yvdwU= =1xq4 -----END PGP SIGNATURE----- ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users.Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- exclusion Jimmy Hayes (Dec 23)
- Re: exclusion Wes Young (Dec 23)
- <Possible follow-ups>
- RE: exclusion Jimmy Hayes (Dec 23)