[Snort-users] "preprocessor portscan2-ignorehosts" ignored
tschenz-snort-users at ...7018...
Mon Dec 2 23:47:08 EST 2002
> > you might consider putting a BPF on snort to ignore your proxy or
> > something like that.
> BPF?! Blocking ...?
berkeley packet filter
from snort (2.0) --help:
USAGE: /usr/local/snort-2.0-HEAD/bin/snort [-options] <filter options>
<Filter Options> are standard BPF options, as seen in TCPDump
So just have a look at the tcpdump manpage. It would basically be
something like "snort -o -i ... ... ... not host your.proxy.name.or.ip".
Note that ignoring complete hosts by using BPF makes any packets
coming/going (in the case of 'not host') invisible to the whole
snort-process. You might want to tweak the BPF a bit, perhaps like 'not
host ... and not src port ...'...
More information about the Snort-users