Re: snort rule help

[Chris Green <cmg () uab edu>]

"Jeffrey Post" <jpost () edc org> writes:

> I am trying to modify a scan rule so that it ignores two specific hosts.  I
> enclosed them in brackets and have a ! in front of each one, but snort
> still logs this traffic and puts it into the database.  Is it possible to
> exclude two addresses?  Here is the rule I am using.
>
> alert tcp $EXTERNAL_NET any -> [!A.B.C.D,!W.X.Y.Z] 8080 (msg:"SCAN Proxy
> attempt";flags:S; classtype:attempted-recon; sid:620; rev:1;)

Try:

alert tcp $EXTERNAL_NET any -> ![A.B.C.D,W.X.Y.Z] 8080 \
  (msg:"SCAN Proxy attempt";flags:S; classtype:attempted-recon;\
   sid:620; rev:1;)

I think thats the right approach but it's difficult to test here at
the moment.
-- 
Chris Green <cmg () uab edu>
You now have 14 minutes to reach minimum safe distance.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users