[ossec-list] Whitelist - Reverse Lookups

["Shohn Trojacek" <trojacek@xxxxxxxxx>]

Okay, I had setup a rule to shun systems scanning my system by keying in on the firewall DENY messages. Works great for the most part; however, for some reason when I go to use google maps, they like to try to connect to a couple of ports that will not be open. This generates a DENY from the firewall, and then Google earth is shunned. I presume they are expecting some sort of agent on the client side, perhaps for local caching of the image data or something.

Is there a way to make the white list work by doing a lookup and whitelisting based on domain name as opposed to just network or IP address? 

If the answer is no, which I believe it is, how about an alternative suggestion - could I create some sort of white list based on the port the remote system is attempting to connect to? Any ideas where to start with this please.