[Snort-users] spp_portscan2 questions

Alberto Gonzalez ag-snort at ...7149...
Fri Oct 18 10:48:02 EDT 2002

actually, with 'preprocessor portscan2-ignorehosts: x.x.x.x' it will 
just ignore all portscans from that
specific host. No need to specify a certain port when you want to ignore 

Pauling wrote:

>Having looked around, I don't see any way for me to tell portscan2 to 
>ignore portscans from certain hosts... does anybody know if there is such 
>a way, and also if there is a way to specify, "Ignore portscans from 
>certain hosts from certain ports" specifially?
>Many Thanks

The secret to success is to start from scratch and keep on scratching.

More information about the Snort-users mailing list