Snort mailing list archives

portscan preprocessor and external net


From: marco turr <marco_syslnx () yahoo it>
Date: Tue, 29 Nov 2005 15:10:21 +0100 (CET)

  Hi,
  I have a problem with portscan preprocessor.
  I need to detect scan from $home -> $home and scan from $home -> any.
  I see that in sfportscan and flow-portscan preprocessor there are options like src-ignore-net or ignore-scanners.
  Now if i set one of this options at $EXTERNAL_NET (where  EXTERNAL_NET is !$HOME_NET) i get an error.
  How can i resolve this?
  Thanks a lot

                
---------------------------------
Yahoo! Mail: gratis 1GB per i messaggi, antispam, antivirus, POP3

Current thread: