[Snort-users] portscan-ignorehosts question

Scot Scot scotw at ...125...
Wed Jun 5 21:08:03 EDT 2002


Try this:

[xxx.xxx.xxx.xxx/xx,xxx.xxx.xxx.xxx/xx]  <-- You can add multiple IP's by
using this format.

Scot



----- Original Message -----
From: "Joseph Inserra" <JInserra at ...6010...>
To: <snort-users at lists.sourceforge.net>
Sent: Monday, June 03, 2002 11:28 AM
Subject: [Snort-users] portscan-ignorehosts question


I've been trying to ignore portscans from two servers......My problem is
that I can ignore only one of the two servers.  In the snort.conf file there
is a portscan-ignorehosts section in the preprocessors.  My question is if
you would like to ignore two hosts is there a delimiter character that I'm
missing?  Or is there a better method to accomplish my objective.

Thanks in advance,
Joseph

_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=ort-users





More information about the Snort-users mailing list