[Snort-users] Exclude hosts in snort
JSmalley at ...9849...
Tue Aug 12 08:34:18 EDT 2003
I have searched the posts and web and can't seem to find an easy/working
way to exclude host from snort. I have thousands of alert from multiple
servers on my network. I am trying to find a way to tell snort
"globally" not to pay attention to these hosts. I would like to be able
to add this to the snort.conf file so I can copy this file to my other
sensors. I have used the command line "not host" options which does work
but I have way to many hosts to use that. I don't want to edit every
rule file. Basically I want to be able to add a host to one location,
restart snort and be done with it. any help is appreciated, thanks
P.S. I'm running redhat 8
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users