[Snort-users] Problems.

Tolpanov, Dmitry tdn at ...2377...
Mon Jun 25 21:37:40 EDT 2001


You did not understand.
I've install snort on the host 217.106.127.X/32, it is the address of the
end station, and such notation is shown in snort.conf example (X because i
don't want to show full IP).

Dmitry.

> -----Original Message-----
> From: Johnson, David [mailto:DJohnson at ...2087...]
> Sent: Monday, June 25, 2001 7:46 PM
> To: 'Tolpanov, Dmitry'; 'snort-users at lists.sourceforge.net'
> Subject: RE: [Snort-users] Problems.
> 
> 
> You need to change your CIDR to /24.  Otherwise the program 
> is looking only
> for the address 217.106.127.0 (with 32-bit net mask)
> 
> -----Original Message-----
> From: Tolpanov, Dmitry [mailto:tdn at ...2377...]
> Sent: Monday, June 25, 2001 2:12 AM
> To: 'snort-users at lists.sourceforge.net'
> Subject: [Snort-users] Problems.
> 
> 
> Hi, all.
> 
> I use snort-1.7. In my snort.conf there is line:
> 
> preprocessor portscan-ignorehosts: 217.106.127.X/32
> 
> Nevertheless it looks like this option doesn't work. May be i 
> must change
> something else?
> 
> I've used following lines with the same result
> 
> var DNS_SERVERS [217.106.127.X/32]
> preprocessor portscan-ignorehosts: $DNS_SERVERS
> 
> Some additions:
> I run snort with -c,-l,-D,-p options.
> Snort is on the same 217.106.127.X/32.
> My uname: FreeBSD online.tomsk.net 2.2.8-19990102-SNAP FreeBSD
> 2.2.8-19990102-SNAP #0: Wed  Dec  8 17:13:47 KRS 1999
> root at ...2378...:/usr/src/sys/compile/ONLINE  i386
> 
> Thanks for future help. :))
> 
> Dmitry.
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 




More information about the Snort-users mailing list