[Snort-users] reputation preprocessor and IDS

JJC cummingsj at ...11827...
Tue Jun 4 15:36:37 EDT 2013


Yes, the IP Rep preprocessor works in passive mode just like it does in
inline mode, other than drop of course.


On Tue, Jun 4, 2013 at 1:27 PM, waldo kitty <wkitty42 at ...14940...> wrote:

>
> does the reputation preprocessor work in IDS (non-inline) mode?
>
> eg: if one places an IP in the whitelist, that IP still generates alerts.
> it
> should not, should it? shouldn't it just pass right on thru all processing?
>
> --
> NOTE: No off-list assistance is given without prior approval.
>        Please keep mailing list traffic on the list unless
>        private contact is specifically requested and granted.
>
>
> ------------------------------------------------------------------------------
> How ServiceNow helps IT people transform IT departments:
> 1. A cloud service to automate IT design, transition and operations
> 2. Dashboards that offer high-level views of enterprise services
> 3. A single system of record for all IT processes
> http://p.sf.net/sfu/servicenow-d2d-j
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130604/03d2949a/attachment.html>


More information about the Snort-users mailing list