Snort mailing list archives
RE: exclusion
From: "Jimmy Hayes" <jhayes () verilet com>
Date: Thu, 23 Dec 2004 10:46:04 -0800
Is there anything that I have to add in onrder for this directive to work? I tried it but it says unknown directive. I have the snort.conf. Also would I be able to exclude only the port 80 on the server. thanks -----Original Message----- From: Wes Young [mailto:wcyoung () buffalo edu] Sent: Thursday, December 23, 2004 10:03 AM To: Jimmy Hayes Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] exclusion -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 have you tired the berkly packet filter rules?? config filter: not ip .... in teh snort.conf (or barnyard.conf) Jimmy Hayes wrote: | Hello I have a server that I want to exclude the alerts from happening. | In this case it's port 80. | I know I can exclude IP's and ports from rules. But I want to be able to | exclude all rules for a server on | Port 80. | | Any ideas? | | I tried preprocessor portscan-ignorehosts: x.x.x.x/32 80, but seems like | that doesn't do it. | | Thanks in advance. | | | | ------------------------------------------------------- | SF email is sponsored by - The IT Product Guide | Read honest & candid reviews on hundreds of IT Products from real users. | Discover which products truly live up to the hype. Start reading now. | http://productguide.itmanagersjournal.com/ | _______________________________________________ | Snort-users mailing list | Snort-users () lists sourceforge net | Go to this URL to change user options or unsubscribe: | https://lists.sourceforge.net/lists/listinfo/snort-users | Snort-users list archive: | http://www.geocrawler.com/redir-sf.php3?list=ort-users | | - -- Wes Young Network Security Analyst University at Buffalo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (MingW32) iD8DBQFBywhwzLe0Tk6uDXYRAjOqAKCR1OLACOhlStOh+MVaIQZ/aM1G/gCeNFhi zw95yNY6SvLA2B4qO0yvdwU= =1xq4 -----END PGP SIGNATURE----- ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- exclusion Jimmy Hayes (Dec 23)
- Re: exclusion Wes Young (Dec 23)
- <Possible follow-ups>
- RE: exclusion Jimmy Hayes (Dec 23)