Snort mailing list archives
My http server is port 8080, how do I change rules file/s?
From: "Vadim Pushkin" <wiskbroom () hotmail com>
Date: Tue, 30 Apr 2002 14:52:04 +0000
I've changed the lines in my snort.conf to the following, yet I am still recvg alerts for portscans to my http servers for port 8080. What is the proper method for doing this, or did I already do it right? And how/where can I add another host and port, different subnet, to the exclude/ignore list/s? Is there any way to take a cisco acl and convert easily to a snort rules set? preprocessor unidecode: 8080 -unicode -cginullpreprocessor portscan-ignorehosts:\ [192.168.1.0/32,10.10.0.0/32,10.11.0.0/32]
var HOME_NET 192.168.1.0/24 var SMTP 192.168.1.0/24 var HTTP_SERVERS 192.168.11.41,192.168.1.42 _________________________________________________________________MSN Photos is the easiest way to share and print your photos: http://photos.msn.com/support/worldwide.aspx
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- My http server is port 8080, how do I change rules file/s? Vadim Pushkin (Apr 30)