[Snort-users] portscan ignore hosts -- different scenario

Mike Sapsara MSapsara at ...1921...
Thu Oct 11 06:36:14 EDT 2001


I'm getting a lot of portscan alerts, coming from dns servers to my vpn
client ip addresses.  I verified that I can add a specific host/cidr to
the preprocessor ignore-hosts, and it is indeed not reported.  The
problem is, these dns hits are not coming from my own dns servers, so I
can't really add them to be ignored.  I don't want to have an
ignore-hosts that includes all addresses, because that would undoubtably
be too strict.

What I want is a way to drop portscan alerting of host:53 -> [ a
specific range of vpn client ip's].

Suggestions ?

-mike




More information about the Snort-users mailing list