[Snort-users] "preprocessor portscan2-ignorehosts" ignored

Jens Krabbenhoeft tschenz-snort-users at ...7018...
Mon Dec 2 23:47:08 EST 2002


Helmut,

> > you might consider putting a BPF on snort to ignore your proxy or
> > something like that.
> BPF?! Blocking ...?

berkeley packet filter

from snort (2.0) --help:

USAGE: /usr/local/snort-2.0-HEAD/bin/snort [-options] <filter options>
                                                      ^^^^^^^^^^^^^^^^
<Filter Options> are standard BPF options, as seen in TCPDump

So just have a look at the tcpdump manpage. It would basically be
something like "snort -o -i ... ... ... not host your.proxy.name.or.ip".

Note that ignoring complete hosts by using BPF makes any packets
coming/going (in the case of 'not host') invisible to the whole
snort-process. You might want to tweak the BPF a bit, perhaps like 'not
host ... and not src port ...'... 

HTH,
	Jens




More information about the Snort-users mailing list