|
|
|
|
Snort Forums Archive
Archive Home » Snort Advanced » Ignoring certain IP address'
Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.
[ Notice: Full Version of This Topic ]
Ignoring certain IP address'
Posted by amd599 on March 25, 2005 12:58:39
Today I found out that a lot of my network traffic that SNORT is picking ip is coming from our printers. I have the IP address' of about 15 printers that are connected, how can I set SNORT to ignore those IP address'? You mentioned something about 'surpress' but I'm not sure exactly how that works. I'm looking through the SNORT Manual but can't seem to find anything on it. Please let me know, thanks again. |
|
Posted by jvhaysx on March 28, 2005 03:40:10
Instructions for adding supression commands are at the end of the sample snort.conf, which in turn refers to the sample threshold.conf. |
|
Posted by nigel on April 07, 2005 09:23:09
A BPF filter to ignore those addresses will work for you if that's what you want to do. |
|
|
|
|
|
