Re: No clue?

[John Friedman <jfriedmanx () yahoo com>]

Thank you for your help.  Here is the config in my
snort.conf

preprocessor sfportscan: proto  { all } \
                         memcap { 10000000 } \
                         sense_level { low }
ignore_scanners { 10.1.10.6 } 

But, If I add ignore_scanners { 10.1.10.6 } to the
snort.conf, the snort service can not be started.  If
I remove ignore_scanners { 10.1.10.6 }, then the snort
service is started fine.  No idea why?

Thanks,

John 

--- Joel Esler <joel.esler () sourcefire com> wrote:

> You need to put them into the sfportscan
> preprocessor as either  
> ignore_scanned or ignore_scanner if you want to tune
> the portscan  
> preprocessor.
>
> Joel Esler
>
>
>
> On Nov 15, 2005, at 11:27 AM, John Friedman wrote:
>
> > I constantly get these alerts from the citrix
> server:
> >  ID   < Signature >   < Timestamp >   < Source
> Address
> > >   < Dest. Address >   < Layer 4 Proto >
> >             #600-(2-7409)        [snort]
> spp_portscan
> > from 10.1.10.6: 1 connections across 1 hosts:
> TCP(1),
> > UDP(0)        2005-11-15 09:49:12        10.1.10.6
> >    unknown        IP
> >             #601-(2-7410)        [snort]
> spp_portscan
> > from 10.1.10.6: 1 connections across 1 hosts:
> TCP(1),
> > UDP(0)        2005-11-15 09:49:19        10.1.10.6
> >    unknown        IP
> >             #602-(2-7411)        [snort]
> spp_portscan
> > from 10.1.10.6: 1 connections across 1 hosts:
> TCP(1),
> > UDP(0)        2005-11-15 09:49:59        10.1.10.6
> >    unknown        IP
> > *********
> > I use these
> > suppress gen_id 100, sig_id 1
> > suppress gen_id 100, sig_id 2
> > suppress gen_id 100, sig_id 3
> > but it does not work.
> >
> > Any idea?
> >
> > Thanks,
> >
> > John
> >
> >
> > --- Jeruvy <jeruvy () shaw ca> wrote:
> >
> > > Sorry about that, I routinely delete emails from
> > > @yahoo.com due to spam.
> > >
> > > What is the alert SID?  Do you use oinkmaster?
> > >
> > > J.
> > > j e r u v y a t s h a w d o t c a
> > >
> > >
> > > > -----Original Message-----
> > > > From: John Friedman
> [mailto:jfriedmanx () yahoo com]
> > > > Sent: Tuesday, November 15, 2005 8:45 AM
> > > > To: snort
> > > > Subject: RE: [Snort-users] No clue?
> > > >
> > > > Hi all,
> > > >
> > > > Since I did not get any reply on this, is there
> > > any way to
> > > > suppress or pass this alert?
> > > >
> > > > Thanks,
> > > >
> > > > John
> > > >
> > > > John Friedman <jfriedmanx () yahoo com> wrote:
> > > >
> > > >   Thanks for your pointing out.  Here is the info
> > > again:
> > > >     ID      <
> >
> >
> >
> >             
> > __________________________________
> > Yahoo! FareChase: Search multiple travel sites in
> one click.
> > http://farechase.yahoo.com
-------------------------------------------------------
> > This SF.Net email is sponsored by the JBoss Inc. 
> Get Certified Today
> > Register for a JBoss Training Course.  Free
> Certification Exam
> > for All Training Attendees Through End of 2005.
> For more info visit:
> >
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or
> unsubscribe:
> >
https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >



        
                
__________________________________ 
Yahoo! Mail - PC Magazine Editors' Choice 2005 
http://mail.yahoo.com


-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
Register for a JBoss Training Course.  Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users