Snort mailing list archives
Snort & portscans in a proxied environment
From: "Cloppert, Michael" <Michael.Cloppert () 53 com>
Date: Wed, 20 Nov 2002 15:09:37 -0500
I'm looking for ideas on how to keep snort's portscan2 preprocessor from triggering on responses to my proxy server. Over half of the portscans I get are things like: src: some.web.server.outthere dst: my.pos.proxy.server sport: 80 dport: some_ephemeral_port It's obvious to me that these requests are responses to requests my proxy made on behalf of its clients. Adding my.po.proxy.server to portscan2-ignorehosts obviously doesn't do much good, since it's not the source, after all. The only thing I can think of is a daily purge of this sort of data from my portscan.log file. I can't be the only one in the world seeing this... anyone have any solutions that can help me out? Anything would be appreciated. Cheers, Mike ------------------------------------------------------- This sf.net email is sponsored by: Battle your brains against the best in the Thawte Crypto Challenge. Be the first to crack the code - register now: http://www.gothawte.com/rd521.html _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort & portscans in a proxied environment Cloppert, Michael (Nov 20)
- Re: Snort & portscans in a proxied environment Jacob Redding (Nov 20)
- problems with make file and mysql Christopher Cook (Nov 20)
- <Possible follow-ups>
- RE: Snort & portscans in a proxied environment Hicks, John (Nov 20)
- RE: Snort & portscans in a proxied environment Cloppert, Michael (Nov 20)