Ingoring Hosts

[Ayse Ekinci <ayse () deakin edu au>]

Although I have an entry to ignore couple of my servers (yp, networking 
monitoring etc) ...:

        portscan-ignorehosts: x.x.x.1/32  x.x.x.2/32

Snort still will not ingore them and I still recieve the following messages
via syslog:

        2 in 0:15:36: my_host snort: [ID 702911 local1.notice]
        spp_portscan: portscan status from x.x.x.1: 5 connections across 1 hosts:
        TCP(2), UDP(3)

        Nov 11 19:59:19 my_host snort: [ID 702911 local1.notice]
        spp_portscan: End of portscan from x.x.x.2: TOTAL time(1s) hosts(1) TCP(0)
        UDP(5)

        2 in 1:00:00: my_host snort: [ID 702911 local1.notice]
        spp_portscan: PORTSCAN DETECTED from x.x.x.3 (THRESHOLD 4 connections
        exceeded in 0 seconds)

Can anyone tell me what have I missed - please.

Regards & thnx in advance
Ayse

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users