[Snort-users] Exclude IP addresses for all rules

James-lists hackerwacker at ...3784...
Sun Dec 15 13:40:02 EST 2002


> # exclude 192.168.1.1 and 192.168.1.2 from being watched
> var EXCLUDE 192.168.1.1,192.168.1.2
> 
> var HOME_NET [!$EXCLUDE,192.168.1.0/24]


I "think" the expression  "[!$EXCLUDE,192.168.1.0/24]"
does not work the way you expect. 192.168.1.1 & 192.168.1.2
are not excluded.





More information about the Snort-users mailing list