[Snort-users] ignore traffic from specific IP

Nick Moore nmoore at ...1935...
Fri Jul 9 16:00:12 EDT 2010


Pedro,

If I understand you correctly, what you may want to do is configure
ignore_scanner in the sfportscan preprocessor. Please see README.sfportscan
in your snort rules directory to get more information on how to configure
this.

Hope this helps and happy snorting!

Nick

On Fri, Jul 9, 2010 at 2:50 PM, Pedro Marinho <pppmarinho at ...11827...> wrote:

> Hello gentlemen,
>
> How may i do to tell snort to ignore any traffic coming from or going to a
> specific IP ?
>
> the ports i know we can do this
>
> config ignore_ports: <list of ports>
>
> but i need to ignore a IP that scans the network..
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>



-- 
Nick Moore, SFCE, CISSP, CISA
Sr. Systems Engineer
Voice 708-336-9041
Email nick.moore at ...1935...
IM    nickgmoore (Yahoo)
      nickgmoore38 (AIM)

   ,,_
  o"  )~   Sourcefire - The Creators of Snort
   ''''

www.sourcefire.com         www.snort.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20100709/57658f3d/attachment.html>


More information about the Snort-users mailing list