Snort Forums Archive

Archive Home » Snort Advanced » Disable hosts for portscan and portsweep.

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Disable hosts for portscan and portsweep.

Posted by colforbin5 on August 08, 2005 06:38:20

Hi all:

I just installed the latest snort signatures, and I'm receiving a ton of alerts on legitimate hosts performing tcp/udp portscanning/portsweeping. I tried editing the snort.conf file by adding "ignore_scanners ", but it is not working. I'm trying to disable specific hosts for the following generators:
(portscan) TCP Portsweep
(portscan) TCP Portscan
"" UDP Portsweep
"" UDP Portscan

Can anyone provide me with an example on how to do this?

Thank you,
forbin

Posted by colforbin5 on August 09, 2005 09:04:32

Figured this out myself; really simple. All you need to do is follow the syntax for the sfportscan processor, so add the "ignore_scanners" processor and list the IP's. It looks like my syntax was off the first time I tried this.

Example:

ignore_scanners { [1.2.3.4,230.231.123.2,4.3.2.1] }

For more documention on the sfportscan, check out the snort manual.

-forbin.