[Snort-users] Portscan2-ignorehosts

Matt Kettler mkettler at ...4108...
Thu Sep 11 14:58:47 EDT 2003

At 10:40 AM 9/11/2003 -0300, zottmann at ...8178... wrote:
>I have seen some e-mail messages talking about the Portscan2-ignorehosts
>preprocessor, but I can´t find it for download anywhere....
>Are they talking about Portscan-ignorehosts instead, or I am missing

No, they are two separate things, and you don't need to download anything 
for it.

Just like portscan has an ignorehosts option, portscan2 has an ignore 
option. Providing you're running a version of snort that has portscan2 
support, you can do a line like this:

preprocessor portscan2-ignorehosts:

Just the same as you can do:
preprocessor portscan-ignorehosts:

However these two statements are for completely different preprocessors. If 
you're using classic portscan, use portscan-ignorehosts. If you're using 
portscan2, use portscan2-ignorehosts.

More information about the Snort-users mailing list