[Snort-users] Filtering portscan preprocessor

Paul Halliday paul.halliday at ...11827...
Tue Nov 9 06:23:01 EST 2004


I am trying to filter content from this preprocessor if ports are equal to
80, 445, 389, and 1602.

I notice that there is the option:

preprocessor portscan-ignorehosts: 192.168.1.1/32 192.168.2.0/24

Can I change this to include those ports?
like 10.37.0.0:80 or something?

Thanks.
-- 
_________________
Paul Halliday
http://dp.penix.org

"Diplomacy is the art of saying "Nice doggie!" till you can find a rock."




More information about the Snort-users mailing list