[Snort-users] I must be think why can't I use bpf filters?
scheidell at ...5171...
Wed Jul 10 11:37:02 EDT 2002
I guess something is wrong with me and the way I thought I should use bpf
ifliters (snort 1.86, 1.87beta and 1.87 release)
If I use a bpf filter I don't get ANY alerts.
Starting snort like this:
/usr/local/bin/snort -doDI -m 022 -z \
-c /usr/local/etc/snort.conf -i rl0 -l /var/log/snort \
not src host 10.1.1.10
someone answered, and I guess it wasn't clear, I thought they said that it
was a bug and was being addressed.
What I want is to filter out all events, alerts (at the bpf level) emenating
from host 10.1.1.10.
(no, pass ip 10.1.1.10 any -> any any is not what I want... Im looking to
eliminate stream, fran ang syn alerts as well).
SECNAP Network Security, LLC
Sales: 866-SECNAPNET / (1-866-732-6276)
Main: 561-368-9561 / www.secnap.net
More information about the Snort-users