Snort mailing list archives
RE: Database Plugin - Alert vs. Log
From: "L. Christopher Luther" <CLuther () Xybernaut com>
Date: Mon, 2 Dec 2002 12:20:06 -0500
Always an option, but then again, that's what the portscan plugin is for. Why reinvent the wheel? Better have the portscan plugin normalized to produce consistent output. -----Original Message----- From: Frank Knobbe [mailto:fknobbe () knobbeits com] Sent: Wednesday, November 27, 2002 7:34 PM To: L. Christopher Luther Cc: 'Erek Adams'; Snort-Users (E-mail) Subject: RE: [Snort-users] Database Plugin - Alert vs. Log On Wed, 2002-11-27 at 17:04, L. Christopher Luther wrote:
When o when will the portscan data be normalized so that it can cleanly be put into a database?! Sigh...
Why don't you write some Snort rules that detect portscans? Create rules that fire when unused IP's are accessed, and/or when used ports (on used IP's) are accessed. That way you have the scan in a normal format in the database. Frank
Current thread:
- Database Plugin - Alert vs. Log L. Christopher Luther (Nov 27)
- Re: Database Plugin - Alert vs. Log Erek Adams (Nov 27)
- <Possible follow-ups>
- RE: Database Plugin - Alert vs. Log L. Christopher Luther (Nov 27)
- RE: Database Plugin - Alert vs. Log Frank Knobbe (Nov 27)
- RE: Database Plugin - Alert vs. Log L. Christopher Luther (Dec 02)
- RE: Database Plugin - Alert vs. Log Frank Knobbe (Dec 02)