[Snort-users] portscan question

Dr SuSE drsuse at ...748...
Mon Nov 13 10:57:27 EST 2000


I asked this in the Snort forum and JoeMCA posted a working solution. Look
for a posting in the "Configuration" section on the Snort forum that reads "ignoring multiple
dns server" .

Dr SuSE

"Microsoft ist nicht installiert"

On Tue, 14 Nov 2000, [gb2312] ������ wrote:

> My snort version is 1.6.3+p2,my rules file looks like:
> 
> preprocessor portscan-ignorehosts: $DNSSERVERS
> preprocessor portscan: $HOME_NET 3 5 /var/log/snort/portscan.log
> 
> I defined the ignorehosts $DNSSERVERS,but portscan module still 
> display my dns server in portscan.log.
> 
> Can anybody tell me why?
> 
> Thanks.
> 
> 
> 




More information about the Snort-users mailing list