[Snort-users] portscan ignore hosts -- different scenario
MSapsara at ...1921...
Thu Oct 11 06:36:14 EDT 2001
I'm getting a lot of portscan alerts, coming from dns servers to my vpn
client ip addresses. I verified that I can add a specific host/cidr to
the preprocessor ignore-hosts, and it is indeed not reported. The
problem is, these dns hits are not coming from my own dns servers, so I
can't really add them to be ignored. I don't want to have an
ignore-hosts that includes all addresses, because that would undoubtably
be too strict.
What I want is a way to drop portscan alerting of host:53 -> [ a
specific range of vpn client ip's].
More information about the Snort-users