[Snort-users] Portscan2-ignorehosts

Matt Kettler mkettler at ...4108...
Thu Sep 11 14:58:47 EDT 2003


At 10:40 AM 9/11/2003 -0300, zottmann at ...8178... wrote:
>I have seen some e-mail messages talking about the Portscan2-ignorehosts
>preprocessor, but I can´t find it for download anywhere....
>
>Are they talking about Portscan-ignorehosts instead, or I am missing
>something?

No, they are two separate things, and you don't need to download anything 
for it.

Just like portscan has an ignorehosts option, portscan2 has an ignore 
option. Providing you're running a version of snort that has portscan2 
support, you can do a line like this:

preprocessor portscan2-ignorehosts: 10.1.1.1

Just the same as you can do:
preprocessor portscan-ignorehosts: 10.1.1.1

However these two statements are for completely different preprocessors. If 
you're using classic portscan, use portscan-ignorehosts. If you're using 
portscan2, use portscan2-ignorehosts.








More information about the Snort-users mailing list