Does snort.conf have conflicting comments?

[Erek Adams <erek () theadamsfamily net>]

In looking at the current (CVS) snort.conf, I noticed something.

Lines 37-42 discuss how to set the HOME_NET variable.  They mention how to
place multiple IP's into a list.

    37  # You can specify lists of IP addresses for HOME_NET
    38  # by separating the IPs with commas like this:
    39  #
    40  # var HOME_NET [10.1.1.0/24,192.168.1.0/24]
    41  #
    42  # MAKE SURE YOU DON'T PLACE ANY SPACES IN YOUR LIST!

Now, looking down a bit....

   227  # Use portscan-ignorehosts to ignore TCP SYN and UDP "scans" from
   228  # specific networks or hosts to reduce false alerts. It is typical
   229  # to see many false alerts from DNS servers so you may want to
   230  # add your DNS servers here. You can all multiple hosts/networks
   231  # in a whitespace-delimited list.
   232  #
   233  preprocessor portscan-ignorehosts: $DNS_SERVERS

It refers to a 'whitespace delimited list'.

Is this right, wrong, or a feature of using a variable in the ignorehosts
line?  Or do I just need to get some coffee?  :)

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users