[Snort-users] Snort + BB: Ignore BB Activity

Dushyanth Harinath dushy at ...5318...
Thu Aug 29 00:40:02 EDT 2002


Hi , 

 * <Joseph.Warner at ...6725...> wrote from a remote bunker :
 
> Everything seems to work properly with the exception
> of the BB server's activity showing up as spp_portscans
> in my snort logs.  How do I get this to stop?

use the portscan-ignorehosts preprocessor.

put 'preprocessor portscan-ignorehosts: $IP' into your snort.conf.
Replace $IP with your BB server's IP and then restart snort.

HTH
dushyanth
-- 
The Definition of an Upgrade: Take old bugs out, put new ones in.

http://symonds.net/~dushy




More information about the Snort-users mailing list