[Snort-users] spp_portscan2 issues

Matt Kettler mkettler at ...4108...
Thu Apr 15 10:25:03 EDT 2004


At 06:24 PM 4/14/2004, Marlon.Richards at ...11130... wrote:
>I have a software for web filtering ( websense ). All URL requests are sent
>to the server which then determines if the site is to be allowed or
>blocked. When this happens i get  spp_portscan2 alerts on my snort console.
>How can i filter out this alert? I am running snort on windows 2000. Thanks
>in advance.

use a "preprocessor spp_portscan2-ignorehosts" statement to ignore that 
hose or set up a command-line BPF to bypass the traffic from snort entirely. 





More information about the Snort-users mailing list