Syntax for ignore ports in Preprocs Portscan Detection
I tried to set up an ip with its ports in Ignore Scanned in the WAN Preprocs section of snort, but snort still does not start due to this error:
FATAL ERROR: /usr/local/etc/snort/snort_2190_re1/snort.conf(359) => Invalid ip_list to 'ignore_scanned' option.
I've tried this way and others but they do not work:
Where am I wrong to write to ignore these three doors?
How can I write it well without snort blocking on startup?
Nobody has an idea to help me?