[Snort-devel] Snort Version 2.0.0 (Build 72) and up & portscan2-ignorehosts

Erek Adams erek at ...835...
Tue Jul 15 12:22:15 EDT 2003

On Mon, 14 Jul 2003, Sean Wheeler wrote:

> I noticed the following in when using \ in defining a long list of ip
> addresses.
> However the notation works fine with rules, but does not work with the
> portscan2-ignorehosts directive


Yep.  Different parsers.

Fix?  Either patch the portscan(2) parser to accept it, or just have it
all on one line.


Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson

More information about the Snort-devel mailing list