Re: Ignoring ports

[Chris Green <cmg () uab edu>]

"Joshua Thomas" <thomasj () engr uconn edu> writes:

> How do I ignore arbirtary ports with out rewriting all the rules?
> For example, kazza runs on port 1214; how can I make all my rules not
> trigger on port 1214 traffic?

pcap filter of 'not tcp and port 1214 '

or

pass tcp any any <-> any 1214
along with using snort -o

Beware that this will open one for attacks due to clever attackers
using 1214 as a source port for the attack.

Someday, snort might be able to tell what kinda traffic it is and
possibly ignore it based on that.
-- 
Chris Green <cmg () uab edu>
"I'm beginning to think that my router may be confused."

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users