[Snort-users] portscan-ignorehosts question

Joseph Inserra JInserra at ...6010...
Tue Jun 4 17:11:16 EDT 2002


I've been trying to ignore portscans from two servers......My problem is that I can ignore only one of the two servers.  In the snort.conf file there is a portscan-ignorehosts section in the preprocessors.  My question is if you would like to ignore two hosts is there a delimiter character that I'm missing?  Or is there a better method to accomplish my objective.

Thanks in advance,
Joseph




More information about the Snort-users mailing list