[Snort-users] portscan-ignorhosts

Vitaly McLain twistah at ...93...
Mon Jan 22 01:28:33 EST 2001


You should be able to simply do:

preprocessor portscan-ignorehosts: host1 host2 host3 host 4

This has worked for me from at least version 1.6, so it should work for you
(and yes, I did use this with Snort 1.6.3.)

Vitaly McLain
twistah at ...93...
twistah @ OPN & EfNet
"If you don't turn on to politics, politics will turn on you."
       - Ralph Nader





More information about the Snort-users mailing list