Snort Forums Archive

Archive Home » Snort Newbies » How to ignore a number of hosts?

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

How to ignore a number of hosts?

Posted by buysellsnort on March 22, 2005 09:55:44

Hello,

I'm running Snort Windows version 2.3.2.
What is the Snort parameter that I can use to ignore: host1, host2, host3

Thanks in advance.

Posted by maverick on March 22, 2005 12:49:46

You can ignore them in a bpf.

not host xxx.xxx.xxx.xxx and not host xxx.xxx.xxx.xxx

Posted by jbugh on April 29, 2005 12:34:41

The way I do it is just put in something like this into the local.rules

pass tcp 130.161.45.252 any -> 165.91.148.159 any (msg: "Ignore Fedora Update Traffic";)

I pass all admin IP addresses since we have very strict rules that catch port 80 traffic to this IP.

Jon