[Snort-users] How to ignore scan from a host
adrian at ...5989...
Sat Jun 1 19:29:02 EDT 2002
I am using snort 1.8.6 build 105, and I start it like this:
/usr/local/snort/bin/snort -C -A full -D -u nobody -g nobody -c
not host 22.214.171.124 and host 126.96.36.199 and host 188.8.131.52
My problem is that if I add more than three hosts to the 'not host' option,
snort gives me this error:
Jun 1 22:07:22 kiki snort: ERROR: OpenPcap() FSM compilation failed:
^Iexpression rejects all packets
Jun 1 22:07:22 kiki snort: FATAL ERROR: PCAP command: not host 184.108.40.206
and host 220.127.116.11 and host 18.104.22.168 and host 22.214.171.124
Is there a way to completely ignore a list of hosts except for the 'not
host' option? Why does snort give this error?
More information about the Snort-users