Portscan Module Tweaking

["Paul Asadoorian" <Paul_Asadoorian () brown edu>]

I am currently using snort to monitor a 130mb link, load balanced across 3
sensors reporting back to a central database.  I have the following issues
when I activate the portscan module:

1. No matter how I tweak the ports per second settings (4 3, 4 2, 7 2) I
still get false positives from load balancers on port 6709.
2. I also get many false positives that look like this:

Oct 16 11:00:00 192.193.195.132:80 -> MY.NET.68.35:1994 INVALIDACK ***A*R*F

I assume that this is caused by a load balancer as well.

Any suggestions on how to handle these problems?  I can keep adding IP
addresses to the ignore hosts until I am blue in the face, but that doesn't
really solve the problem.  <Feature Request> It would be nice if I could add
ports to the ignore list (both source and destination) to help weed out the
false positives </Feature Request>.

Thanks,

Paul Asadoorian, GCIA
Brown University



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users