Re: Exclude hosts in snort

[Bryan Irvine <bryan.irvine () kingcountyjournal com>]

perhaps make a file called something like NotHosts

host1, host2, host3, host4, host5, host6

then start snort

snort -youroptions not host '`cat NotHosts`'

then all you would have to would edit your NotHost file kill your snort
sessions

kill `cat /var/run/snort*`

and restart snort.  Of course if you are using database logging a new
filter would get generated each time you added a host to it.  It might
look confusing in ACID.  I'd just go removed the old ones manually.

--Bryan



On Mon, 2003-08-11 at 09:01, Jason wrote:
> I have searched the posts and web and can't seem to find an
> easy/working way to exclude host from snort. I have thousands of alert
> from multiple servers on my network. I am trying to find a way to tell
> snort "globally" not to pay attention to these hosts. I would like to
> be able to add this to the snort.conf file so I can copy this file to
> my other sensors. I have used the command line "not host" options
> which does work but I have way to many hosts to use that. I don't want
> to edit every rule file. Basically I want to be able to add a host to
> one location, restart snort and be done with it. any help is
> appreciated, thanks
>  
> Jason
>  
>  
> P.S. I'm running redhat 8



-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users