portscan ignore hosts -- different scenario

[Mike Sapsara <MSapsara () longsys com>]

I'm getting a lot of portscan alerts, coming from dns servers to my vpn
client ip addresses.  I verified that I can add a specific host/cidr to
the preprocessor ignore-hosts, and it is indeed not reported.  The
problem is, these dns hits are not coming from my own dns servers, so I
can't really add them to be ignored.  I don't want to have an
ignore-hosts that includes all addresses, because that would undoubtably
be too strict.

What I want is a way to drop portscan alerting of host:53 -> [ a
specific range of vpn client ip's].

Suggestions ?

-mike

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users