[Snort-users] problems with ignoring of hosts

Victor Usjanov victor at ...5041...
Thu Feb 21 11:12:02 EST 2002


I am trying to ignore some hosts. Two of them are DNS servers, so i have
placed them in (var DNS_SERVERS),
but they still keep comming. I have tried both IP addresses and IP-adresses
with network bits
(xxx.xx.xx.xxx/24). Others went to (preprocessor
portscan-ignorehosts:) in a whitespace separated list, but they still keep
comming ( i do use ip with network bits there too).

Someone has an idea on what can be wrong, and how can i ignore those hosts?
It is 6 hosts i want to ignore. I get lots of ICMP Echo Replys from them.

Another thing - how do i ignore and is it safe to do it or not ?

Thank you in advance.


More information about the Snort-users mailing list