Re: Problems ignoring a host

[Erek Adams <erek () theadamsfamily net>]

On Tue, 12 Feb 2002, Peter Sundstrom wrote:

> I'm trying to ignore alerts triggered by our scanner without any luck.

[...snip...]

> What am I missing?

The fact that the portscan alerts are generated by ssp_portscan.{c,h} and not
snort.  Since that's from a pre-processor, pass rules won't help.  Use the
config file directive "portscan ignorehosts" or use a BPF filter to ignore
traffic from that host.

Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users