Snort mailing list archives

My http server is port 8080, how do I change rules file/s?


From: "Vadim Pushkin" <wiskbroom () hotmail com>
Date: Tue, 30 Apr 2002 14:52:04 +0000


I've changed the lines in my snort.conf to the following, yet
I am still recvg alerts for portscans to my http servers for
port 8080. What is the proper method for doing this, or did I
already do it right? And how/where can I add another host and
port, different subnet, to the exclude/ignore list/s?

Is there any way to take a cisco acl and convert easily to
a snort rules set?

preprocessor unidecode: 8080 -unicode -cginull

preprocessor portscan-ignorehosts:\ [192.168.1.0/32,10.10.0.0/32,10.11.0.0/32]

var HOME_NET 192.168.1.0/24
var SMTP 192.168.1.0/24
var HTTP_SERVERS 192.168.11.41,192.168.1.42




_________________________________________________________________
MSN Photos is the easiest way to share and print your photos: http://photos.msn.com/support/worldwide.aspx


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: