[Snort-users] IP Question

Moyer, Shawn SMoyer at ...5894...
Thu Jul 25 14:56:03 EDT 2002


I use local.rules, but I place it in a different directory so it's not
overwritten by my update scripts, and point to it in snort.conf. Point is,
it doesn't matter where it is, as long as snort reads it when it parses the
rules (see the list of rules that are enabled in snort.conf).


--shawn

> -----Original Message-----
> From: McCammon, Keith [mailto:Keith.McCammon at ...3497...]
> Sent: Thursday, July 25, 2002 16:31
> To: Jim Gifford; snort-users at lists.sourceforge.net
> Subject: RE: [Snort-users] IP Question
> 
> 
> You can place a pass rule anywhere that you 
> want--local.rules, pass.rules, snort.conf, etc.  If you 
> auto-update rules files, you'll want to put it in a file that 
> won't be overwritten (i.e., pass.rules).
> 
> Also, if you want to flat out ignore *everything* to and from 
> that host, you can add a filter (not host x.x.x.x) at the 
> command-line.
> 
> > -----Original Message-----
> > From: Jim Gifford [mailto:maillist at ...6454...]
> > Sent: Thursday, July 25, 2002 5:18 PM
> > To: snort-users at lists.sourceforge.net
> > Subject: [Snort-users] IP Question
> > 
> > 
> > Just wanted to make sure if I want to disable alerts from a 
> certain IP
> > address, I need to place it the local.rules file
> > 
> > 
> > -------------------------------------------------------
> > This sf.net email is sponsored by: Jabber - The world's 
> > fastest growing 
> > real-time communications platform! Don't just IM. Build it in! 
> > http://www.jabber.com/osdn/xim
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > 
> 
> 
> -------------------------------------------------------
> This sf.net email is sponsored by: Jabber - The world's 
> fastest growing 
> real-time communications platform! Don't just IM. Build it in! 
> http://www.jabber.com/osdn/xim
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 




More information about the Snort-users mailing list