Snort mailing list archives
Re: ACID + spp_portscan
From: dmuz <dmuz () slatibartfast angrypacket com>
Date: Thu, 24 May 2001 12:55:31 -0700
On Thu, May 24, 2001 at 02:30:26PM +0000, roman () danyliw com said:
- In the extremely near future, ACID could merely ignore "spp_portscans" in the unique alerts page, and create another page which merely lists these messages? Any interest?
This sounds like a good way to deal with the issue. Perhaps a config var that can control whether to split spp_portscan alerts out to another page? This way you can still include them in the main alert view if you desire.
- Snort internals need to be changed so that pre-processor alerts communitcate in a well-formed manner with output plugins. This will eliminate 1-signature per every portscan.
Can anyone chime in on what the current plans are to in this respect?
RomanHi all, any idea how I can avoid having lots of different "signatures" generated by spp_portscan in my database? At the moment they are making the "unique signatures" page a little unreadable. cheers Tom
-- dmuz http://sec.angrypacket.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- ACID + spp_portscan Thomas Whipp (May 24)
- <Possible follow-ups>
- Re: ACID + spp_portscan roman (May 24)
- Re: ACID + spp_portscan dmuz (May 24)