[Snort-users] Global Exceptions - how to ignore vulnerability scanners?

Brian bmc at ...950...
Wed Jan 2 14:28:02 EST 2002


According to Jeff Newton:
> 
> Is there a way to configure a global exception to all rules and
> preprocessors for specific hosts?  Eg. vulnerability scanners
> 
> Maybe you specify EXTERNAL_NET = [any,!<ip_address>] ??

Add to the commandline "not host ip"

-- 
Developing error messages? Doesn't Windows have enough of these already? 
And we need a whole fscking book on how to do this?" 
-- Derick Siddoway on O'Reilly NT books





More information about the Snort-users mailing list