Because you have to include it in the line prior.. See how the lines
prior to that have "\"? You have to put the "\" in the line prior to
the ignore_scanners line if you want it included..
J
On Nov 15, 2005, at 3:14 PM, John Friedman wrote:
Thank you for your help. Here is the config in my
snort.conf
preprocessor sfportscan: proto { all } \
memcap { 10000000 } \
sense_level { low }
ignore_scanners { 10.1.10.6 }
But, If I add ignore_scanners { 10.1.10.6 } to the
snort.conf, the snort service can not be started. If
I remove ignore_scanners { 10.1.10.6 }, then the snort
service is started fine. No idea why?
Thanks,
John
--- Joel Esler <joel.esler@sourcefire.com> wrote:
You need to put them into the sfportscan
preprocessor as either
ignore_scanned or ignore_scanner if you want to tune
the portscan
preprocessor.
Joel Esler
On Nov 15, 2005, at 11:27 AM, John Friedman wrote:
I constantly get these alerts from the citrix
server:
ID < Signature > < Timestamp > < Source
Address
< Dest. Address > < Layer 4 Proto >
#600-(2-7409) [snort]
spp_portscan
from 10.1.10.6: 1 connections across 1 hosts:
TCP(1),
UDP(0) 2005-11-15 09:49:12 10.1.10.6
unknown IP
#601-(2-7410) [snort]
spp_portscan
from 10.1.10.6: 1 connections across 1 hosts:
TCP(1),
UDP(0) 2005-11-15 09:49:19 10.1.10.6
unknown IP
#602-(2-7411) [snort]
spp_portscan
from 10.1.10.6: 1 connections across 1 hosts:
TCP(1),
UDP(0) 2005-11-15 09:49:59 10.1.10.6
unknown IP
*********
I use these
suppress gen_id 100, sig_id 1
suppress gen_id 100, sig_id 2
suppress gen_id 100, sig_id 3
but it does not work.
Any idea?
Thanks,
John
--- Jeruvy <jeruvy@shaw.ca> wrote:
Sorry about that, I routinely delete emails from
@yahoo.com due to spam.
What is the alert SID? Do you use oinkmaster?
J.
j e r u v y a t s h a w d o t c a
-----Original Message-----
From: John Friedman
[mailto:jfriedmanx@yahoo.com]
Sent: Tuesday, November 15, 2005 8:45 AM
To: snort
Subject: RE: [Snort-users] No clue?
Hi all,
Since I did not get any reply on this, is there
any way to
suppress or pass this alert?
Thanks,
John
John Friedman <jfriedmanx@yahoo.com> wrote:
Thanks for your pointing out. Here is the info
again:
ID <
__________________________________
Yahoo! FareChase: Search multiple travel sites in
one click.
http://farechase.yahoo.com
-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.
Get Certified Today
Register for a JBoss Training Course. Free
Certification Exam
for All Training Attendees Through End of 2005.
For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or
unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
__________________________________
Yahoo! Mail - PC Magazine Editors' Choice 2005
http://mail.yahoo.com
-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc. Get Certified Today
Register for a JBoss Training Course. Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
