[Snort-users] excluding a host from rule

Chang, Andre achang at ...5965...
Thu May 30 14:21:02 EDT 2002


Can you exclude specific hosts from triggering the alert in a rule?  But
still get alerted by that rule if any other hosts try the same action.
Example you have a port scan on your network and you do not want to get
alerted by that host doing the scan but you do want to get alerted by anyone
else performing a port scan.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20020530/2d6f0ed2/attachment.html>


More information about the Snort-users mailing list