mkettler at ...4108...
Thu Sep 11 14:58:47 EDT 2003
At 10:40 AM 9/11/2003 -0300, zottmann at ...8178... wrote:
>I have seen some e-mail messages talking about the Portscan2-ignorehosts
>preprocessor, but I can´t find it for download anywhere....
>Are they talking about Portscan-ignorehosts instead, or I am missing
No, they are two separate things, and you don't need to download anything
Just like portscan has an ignorehosts option, portscan2 has an ignore
option. Providing you're running a version of snort that has portscan2
support, you can do a line like this:
preprocessor portscan2-ignorehosts: 10.1.1.1
Just the same as you can do:
preprocessor portscan-ignorehosts: 10.1.1.1
However these two statements are for completely different preprocessors. If
you're using classic portscan, use portscan-ignorehosts. If you're using
portscan2, use portscan2-ignorehosts.
More information about the Snort-users