[Snort-users] portscan question
drsuse at ...748...
Mon Nov 13 10:57:27 EST 2000
I asked this in the Snort forum and JoeMCA posted a working solution. Look
for a posting in the "Configuration" section on the Snort forum that reads "ignoring multiple
dns server" .
"Microsoft ist nicht installiert"
On Tue, 14 Nov 2000, [gb2312] ������ wrote:
> My snort version is 1.6.3+p2,my rules file looks like:
> preprocessor portscan-ignorehosts: $DNSSERVERS
> preprocessor portscan: $HOME_NET 3 5 /var/log/snort/portscan.log
> I defined the ignorehosts $DNSSERVERS,but portscan module still
> display my dns server in portscan.log.
> Can anybody tell me why?
More information about the Snort-users