[Snort-users] disable http_inspect for external www servers
TBERNHAR at ...12484...
Mon Sep 27 16:56:13 EDT 2004
Running Snort 2.2.0, have http_inspect enableed but 98+% of alerts are
for Traffic between Squid and External WWW Servers.
Is there any way to telll http_inspect to only inspect servers on a
specific subnet (I.E. 192.168.0.0/255.255.0.0)? or to ignore all traffic
from a specific IP Address?
I have read through the doucmentation and browsed the web and have not
had any luck finding an answer.
Senior Technical Engineer
Certified Citrix Metaframe Administrator
Certified CyberGuard Administrator
Certified AIX 4.3 System Administrator
Sun-Maid Growers of California
7273 Murray Drive, Ste 18
Stockton, CA 95210
tbernhar at sunmaid dot com
More information about the Snort-users