Re: portscan preprocessor and external net

[Matt Kettler <mkettler () evi-inc com>]

marco turr wrote:
> */Jason Brvenik <jasonb () sourcefire com>/* ha scritto:
>
>     Variables are not supported for preprocessors. You need to use the
>     actual definitions of the networks and not the variable itself.
>
> So, you say that I must write in ingore-scanners or src-ignore-net ALL
> ip address of internet execpt my subnet? it's crazy :)

Generally speaking, you want to do the opposite. You want to ignore your subnet,
and no others.



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users