[Snort-users] Ignore scanned not playing nice

James Lay jlay at ...13475...
Tue Jun 27 08:49:55 EDT 2006


Hey all.

Here's what I have in my snort.conf:

preprocessor sfportscan: proto  { all } \
                         memcap { 10000000 } \
                         sense_level { low } \
                         ignore_scanners { 192.168.0.3 192.168.0.2 }

Yet here is what I get constantly:

Jun 27 06:47:06 myshield snort[18799]: [122:3:0] (portscan) TCP
Portsweep {PROTO255} 192.168.0.2 -> 208.184.59.164

Did I miss something in the config?  Thanks people!

James




More information about the Snort-users mailing list