[Snort-users] Ignore hosts

Dominic dominic at ...13064...
Sat Mar 5 02:57:04 EST 2005


Hi all,

 

I am running Snort on a pc that also uses ADSL. I am seeing a lot of alerts
generated from my ADSL host and want to ignore these alerts. I have added
"ignore_scanners { $ppp0_ADDRESS }" to my sfportscan config - my problem is
that this works for the current ip, but whenever the ADSL gets it's new ip,
I see alerts from the ADSL host again. I then have to restart snort to use
the new ip address. Does anyone know a way around this?

 

Thanks,

 

Dominic.

 

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050305/ec3800e3/attachment.html>


More information about the Snort-users mailing list