Re: HOWTO Ignore specific IP addresses

[Demetri Mouratis <dmourati () cm math uiuc edu>]

On Tue, 13 May 2003, Michael Parkinson wrote:

> Hi All,
>
> OK slowly going brain dead here.
>
> Current set-up is two web servers attached to a SNAZ NFS server.
>
> When I kick Snort into action it works fine BUT I get literally hundreds of
> false positives :
>
> BAD TRAFFIC bad frag bits
> MISC Large UDP Packet
>
> A simple solution is to tell Snort to ignore this server
> completely....Simply put how do I get Snort to ignore this machine
> completely?

Michael,

Please see:

http://www.snort.org/docs/faq.html#3.7


---------------------------------------------------------------------
Demetri Mouratis
dmourati () linfactory com



-------------------------------------------------------
Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara
The only event dedicated to issues related to Linux enterprise solutions
www.enterpriselinuxforum.com

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users