Snort mailing list archives
Future plans
From: Paul Schmehl <pauls () utdallas edu>
Date: Wed, 26 May 2004 14:20:18 -0500
Are there any plans in the future to allow snort to ignore a comma separated list of ports? This sig, ATTACK-RESPONSES id check returned root, is perfect example of something that would benefit from that ability. I have 177 alerts right now, and the vast majority of them are on ports 25, 80 and 143. Well doh!
I would love to see the ability to list ports like this: alert tcp $EXTERNAL_NET !80 -> $HOME_NET !25,143 (blah) or var IGNORE_EMAIL [25,143] alert tcp $EXTERNAL_NET http -> $HOME_NET !$IGNORE_EMAIL (blah) Please, please, pretty please...... :-) Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/ir/security/ ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10gGet certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- which rules to download lola marais (May 20)
- ANVIL Adriel T. Desautels (May 20)
- Future plans Paul Schmehl (May 26)
- Re: which rules to download Matt Kettler (May 20)
- <Possible follow-ups>
- Re: which rules to download lola marais (May 20)
- ANVIL Adriel T. Desautels (May 20)