[Snort-users] ignore traffic from specific IP

Nick Moore nmoore at ...1935...
Fri Jul 9 16:00:12 EDT 2010


If I understand you correctly, what you may want to do is configure
ignore_scanner in the sfportscan preprocessor. Please see README.sfportscan
in your snort rules directory to get more information on how to configure

Hope this helps and happy snorting!


On Fri, Jul 9, 2010 at 2:50 PM, Pedro Marinho <pppmarinho at ...11827...> wrote:

> Hello gentlemen,
> How may i do to tell snort to ignore any traffic coming from or going to a
> specific IP ?
> the ports i know we can do this
> config ignore_ports: <list of ports>
> but i need to ignore a IP that scans the network..
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

Sr. Systems Engineer
Voice 708-336-9041
Email nick.moore at ...1935...
IM    nickgmoore (Yahoo)
      nickgmoore38 (AIM)

  o"  )~   Sourcefire - The Creators of Snort

www.sourcefire.com         www.snort.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20100709/57658f3d/attachment.html>

More information about the Snort-users mailing list