[Snort-users] several nameservers to be excluded

Mullen, Patrick Patrick.Mullen at ...24...
Tue Aug 1 14:35:33 EDT 2000


> how do you specify several nameservers again in snort-lib? I
> separated them with whitespaces to no effect... 

That's not good.  Are they being triggered as TCP stealth
scans, or regular scans?  TCP stealth is always reported.
This code is being drastically improved with all of the
input I've been getting lately.

Multiple ignorehosts can be specified by separating them
with a space.  They can also be networks, or any mixture
of hosts and subnets.

preprocessor portscan-ignorehosts: server1 server2 server3

Let me know if you need more help.


Thanks,

~Patrick




More information about the Snort-users mailing list