[Snort-users] [Emerging-Sigs] How to exclude one IP address from HOME_NET
jesler at ...1935...
Mon Oct 1 17:39:37 EDT 2012
Glad it helps!
On Oct 1, 2012, at 5:33 PM, Jack Pepper <pepperjack at ...14319...> wrote:
> I did not know this was available. that's a way better (and more inuitive) solution.
> ipvar EXAMPLE [126.96.36.199,188.8.131.52/24,![184.108.40.206,220.127.116.11]]
> On Mon, Oct 1, 2012 at 4:26 PM, Joel Esler <jesler at ...1935...> wrote:
> On Oct 1, 2012, at 3:20 PM, Jack Pepper <pepperjack at ...14319...> wrote:
>> the subject of how to exclude one IP address from HOME_NET still comes up occasionally. Usually it's a proxy server. I wrote a little program a long time ago (2008?) to create a HOME_NET statement with the proxy address excluded. Herewith I offer it to the public (should a done that a long time ago).
> Please see this section of the Snort Manual:
> As it references how to exclude certain IPs within a variable.
> Also Cc'ing the Snort-users list, as this is a Snort issue (not an emerging-sigs issue) and someone may find it useful.
> Joel Esler
> Senior Research Engineer, VRT
> OpenSource Community Manager
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users