[Snort-users] Re: excluding a host from rule

Alex Pinheiro Machado Rodrigues alex at ...3156...
Thu May 30 14:48:05 EDT 2002


Example: snort -dev -c snort.conf  not host 192.168.200.3

Alex
Brazil


  ----- Original Message ----- 
  From: Chang, Andre 
  To: 'snort-users at lists.sourceforge.net' 
  Sent: Thursday, May 30, 2002 6:19 PM
  Subject: [Snort-users] excluding a host from rule


  Can you exclude specific hosts from triggering the alert in a rule?  But still get alerted by that rule if any other hosts try the same action.

  Example you have a port scan on your network and you do not want to get alerted by that host doing the scan but you do want to get alerted by anyone else performing a port scan.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20020530/ca9c4697/attachment.html>


More information about the Snort-users mailing list