[Snort-devel] re portscan2 preprocessor

Mark Rowlands mark.rowlands at ...333...
Thu May 30 11:34:02 EDT 2002


On Thursday 30 May 2002 2:44 pm, Chris Green wrote:
> Mark Rowlands <mark.rowlands at ...333...> writes:
> > I see ignorehosts options in the source...but I am not a coder, how do
> > you switch these on!
>
> scan2-ignorehosts: 192.168.1.1 192.168.2.1/24
>
> It's still in beta though :-)

hoo har! 

thank you very much...again

if we don't test it,poor little thing is never gonna get out of beta ..... ;.)

notes: 

not sure we want to see these :-

HISTORY time: 05/30-15:55:41.794926  src: 62.5.39.221 dst: 255.255.255.255 
proto: UDP sport: 2010 dport: 27911 dgmlen: 45
HISTORY time: 05/30-15:55:41.794699  src: 62.5.39.221 dst: 255.255.255.255 
proto: UDP sport: 2010 dport: 27910 dgmlen: 45

or

HISTORY time: 05/30-18:27:28.238344  src: 4.0.0.0 dst: 227.37.32.1 proto: IGMP 
sport: 0 dport: 0 dgmlen: 32
HISTORY time: 05/30-18:27:28.237809  src: 4.0.0.0 dst: 224.0.1.113 proto: IGMP 
sport: 0 dport: 0 dgmlen: 32




More information about the Snort-devel mailing list