[Snort-users] disable http_inspect for external www servers

Tim Bernhardson TBERNHAR at ...12484...
Mon Sep 27 16:56:13 EDT 2004


Running Snort 2.2.0, have http_inspect enableed but 98+% of alerts are
for Traffic between Squid and External WWW Servers.
Is there any way to telll http_inspect to only inspect servers on a
specific subnet (I.E. 192.168.0.0/255.255.0.0)? or to ignore all traffic
from a specific IP Address?

I have read through the doucmentation and browsed the web and have not
had any luck finding an answer.

Thanks

Tim Bernhardson
Senior Technical Engineer
Certified Citrix Metaframe Administrator
Certified CyberGuard Administrator
Certified AIX 4.3 System Administrator
Sun-Maid Growers of California
7273 Murray Drive, Ste 18
Stockton, CA 95210

tbernhar at sunmaid dot com




More information about the Snort-users mailing list