white list url on snort

heliop100

Hi,

Is it possible to whitelist an URL?

The http://that.site.com I want to whitelist are on Akamai, and IP changes every time.
Or it save (not sure how) to whitelist all Akamai by ASN? (I know it's possible on pfBlockerNG).

Thanks.

bmeeks

Snort does not support any type of changing or dynamic IP. If you have a list that updates, then you would need to restart Snort each time the list is updated. If you are willing to do that, then you could perhaps use the IP REP tab in Snort to accomplish a whitelist like you want.

NogBadTheBad

Here's the subnet details for their AS number:-

Whois.txt

heliop100

@NogBadTheBad said in white list url on snort:

Here's the subnet details for their AS number:-

Whois.txt

Is it safe to whitelist all AKAMAI?

NogBadTheBad

@heliop100

If http://that.site.com/ keeps moving from one of their IP addresses to another its your only hope, can't vouch for if its safe or not.