Snort mailing list archives
unknown destination ip and portscan false alerts
From: Always Bishan <bishan4u () yahoo co uk>
Date: Sat, 8 Mar 2003 06:56:19 +0000 (GMT)
hi 1) I'm getting lot of alerts of this type, they don't have any destinatiopn IP . My machine containing snort has IP address 192.168.0.3. Signature: portscan alert: spp_portscan detected from 192.168.0.11 (THRESHOLD 4 connections exceeded in 0 seconds) source ip: 192.168.0.11 destination ip: unknown proto: IP 2) i'm getting a lot of portscan alerts to and from port 80,25 and 53. How do I disable alerts to and from these ports? How do I disable portscans from internal network to internet, but keeping portscans from internal network to internal network intact. PLEASE DO HELP OUT! Regards, Bishan __________________________________________________ Do You Yahoo!? Everything you'll ever need on one web page from News and Sport to Email and Music Charts http://uk.my.yahoo.com ------------------------------------------------------- This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger for complex code. Debugging C/C++ programs can leave you feeling lost and disoriented. TotalView can help you find your way. Available on major UNIX and Linux platforms. Try it free. www.etnus.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- unknown destination ip and portscan false alerts Always Bishan (Mar 07)
- Re: unknown destination ip and portscan false alerts Alberto Gonzalez (Mar 08)
- Re: unknown destination ip and portscan false alerts Always Bishan (Mar 08)
- Re: unknown destination ip and portscan false alerts Alberto Gonzalez (Mar 08)