[Snort-users] ignore_host doesn't work ?

Brandis Jaroslav jaroslav.brandis at ...6982...
Tue Dec 17 07:42:13 EST 2002


I have this config lines in snort.conf Snort 1.9.0

preprocessor portscan-ignorehosts: $HOME_NET

preprocessor portscan2: scanners_max 3200, targets_max 5000,
target_limit 5, port_limit 20, timeout 60, log portscan.log

but $HOME_NET address is still in logs as portscanning machine. Whats
wrong ?




More information about the Snort-users mailing list