Syntax for ignore ports in Preprocs Portscan Detection

  • Hi,
    I tried to set up an ip with its ports in Ignore Scanned in the WAN Preprocs section of snort, but snort still does not start due to this error:
    FATAL ERROR: /usr/local/etc/snort/snort_2190_re1/snort.conf(359) => Invalid ip_list to 'ignore_scanned' option.

    I've tried this way and others but they do not work:[/32][5932-6953-87303]

    Where am I wrong to write to ignore these three doors?

  • How can I write it well without snort blocking on startup?

  • Nobody has an idea to help me?

Log in to reply