Ignore hosts

["Dominic" <dominic () multilink co za>]

Hi all,

 

I am running Snort on a pc that also uses ADSL. I am seeing a lot of alerts
generated from my ADSL host and want to ignore these alerts. I have added
"ignore_scanners { $ppp0_ADDRESS }" to my sfportscan config - my problem is
that this works for the current ip, but whenever the ADSL gets it's new ip,
I see alerts from the ADSL host again. I then have to restart snort to use
the new ip address. Does anyone know a way around this?

 

Thanks,

 

Dominic.