Snort IP Lists - whitelist configuration



  • We use the new Snort IP Lists option for whitelisting some key users.  Is it possible in the list to place comments identifying the user.  In the snort suppress list we can place a comment by using the # sign before the comment.  Those this option exist in the IP lists for whitelisting or blacklisting IPs?

    Thanks
    cjb



  • @cjbujold:

    We use the new Snort IP Lists option for whitelisting some key users.  Is it possible in the list to place comments identifying the user.  In the snort suppress list we can place a comment by using the # sign before the comment.  Those this option exist in the IP lists for whitelisting or blacklisting IPs?

    Thanks
    cjb

    Yes, I believe Snort will understand and skip comment lines.  However, the comments will not be parsed and used in any way.  In other words, they won't appear in any logged output.

    Bill


Log in to reply