Snort mailing list archives
Re: [RGSPAM] exclude ip
From: "Lee Clemens" <snort () leeclemens net>
Date: Fri, 7 Jul 2006 18:30:58 -0400
If you want to exclude it for one rule (or a few), just put it in threshold.conf. Check out the user's guide for syntax... -----Original Message----- From: snort-users-bounces () lists sourceforge net [mailto:snort-users-bounces () lists sourceforge net] On Behalf Of Joel Esler Sent: Friday, July 07, 2006 8:05 AM To: fname lname Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] [RGSPAM] exclude ip Can you place it in 'EXTERNAL_NET'? J On Wed, Jul 05, 2006 at 05:08:45PM -0400, fname lname sent me:
If I wanted to exclude an ip from the ids how will i go about doing that. Ex is I wanted to exclude 1.2.3.4 from an smtp rule how can i make that happen?
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
+---------------------------------------------------------------------+ Joel Esler Senior Security Consultant 1-706-627-2101 Sourcefire Security for the /Real/ World -- http://www.sourcefire.com Snort - Open Source Network IPS/IDS -- http://www.snort.org GPG Key http://demo.sourcefire.com/jesler.pgp.key +---------------------------------------------------------------------+ Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- exclude ip fname lname (Jul 05)
- Re: [RGSPAM] exclude ip Joel Esler (Jul 07)
- Re: [RGSPAM] exclude ip Lee Clemens (Jul 07)
- Re: [RGSPAM] exclude ip Al McGale (Jul 10)
- Re: [RGSPAM] Re: [RGSPAM] exclude ip Martin Roesch (Jul 10)
- Re: [RGSPAM] Re: [RGSPAM] exclude ip Jason Brvenik (Jul 10)
- Re: [RGSPAM] exclude ip Paul Halliday (Jul 10)
- Re: [RGSPAM] exclude ip Lee Clemens (Jul 07)
- Re: [RGSPAM] exclude ip Joel Esler (Jul 07)
- <Possible follow-ups>
- Re: exclude ip Michael Scheidell (Jul 06)
- Re: exclude ip Gustavo Monteiro (Jul 06)