[Snort-users] Gethostbyaddr problem

Fyodor fygrave at ...121...
Fri Apr 6 11:59:29 EDT 2001


On Fri, Apr 06, 2001 at 02:36:20PM +0400, ./ wrote:
> Sometime back I found something about false positive for sendmail and I
> can't seem to find it again.  I'm getting this:
> 
>  sendmail[13390]: gethostbyaddr(xx.xx.xx.xx) failed: 1
> 
> from snort and I can't remember how to tell snort to avoid reporting it.
> 

It is not snort, it is sendmail which tries to perform reverse lookups. have a look into
sendmail docs for details how to turn it off. (I forgot the option name.. something like
DoNotResolveIP' or something :))




More information about the Snort-users mailing list