Snort mailing list archives
Re: Portscan2...
From: Erek Adams <erek () snort org>
Date: Sat, 22 Mar 2003 14:51:52 -0500 (EST)
On Sat, 22 Mar 2003, Tobias Rice wrote:
Thanks for the tips, I'll try the ignore options and see if it works for me. But I.m a little confused about the BPF filters, the man page is a little vague. Currently, I.m running snort like so: /usr/sbin/snort-mysql+flexresp -o -i eth0 -c /etc/snort/snort.conf So would it now be: (after creating the file scan.bpf) /usr/sbin/snort-mysql+flexresp -o -i eth0 -c /etc/snort/snort.conf .F bpf_file: /etc/snort/scan.bpf And the file scan.bpf would contain this: not host 111.222.333.444 and not port (53 or 5060)
Not quite: /usr/sbin/snort-mysql+flexresp -o -i eth0 -c /etc/snort/snort.conf -F /etc/snort/scan.bpf Or /usr/sbin/snort-mysql+flexresp -o -i eth0 -c /etc/snort/snort.conf 'not host 111.222.333.444 and not port (53 or 5060)' As one long command line. Or do a bit of creative setup in snort.conf. Add: config order: pass alert log config interface: eth0 config bpf_file: /etc/snort/scan.bpf Then: ln -s /etc/snort/snort.conf /etc/snort.conf Then you could just do: /usr/sbin/snort-mysql+flexresp But, just do whatever works for you. :) That's the important thing. Cheers! ----- Erek Adams "When things get weird, the weird turn pro." H.S. Thompson ------------------------------------------------------- This SF.net email is sponsored by:Crypto Challenge is now open! Get cracking and register here for some mind boggling fun and the chance of winning an Apple iPod: http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0031en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Portscan2... Tobias Rice (Mar 22)
- Re: Portscan2... Erek Adams (Mar 22)
- Re: Portscan2... Tobias Rice (Mar 22)
- Re: Portscan2... Erek Adams (Mar 22)
- Re: Portscan2... Tobias Rice (Mar 22)
- Re: Portscan2... Erek Adams (Mar 22)
- Re: Portscan2... Tobias Rice (Mar 22)
- Re: Portscan2... Alberto Gonzalez (Mar 22)
- Re: Portscan2... Alberto Gonzalez (Mar 22)
- Re: Portscan2... Tobias Rice (Mar 22)
- Re: Portscan2... Erek Adams (Mar 22)
- Re: Portscan2... Jim Burwell (Mar 22)
- Re: Portscan2... Erek Adams (Mar 23)
- Re: Portscan2... Jim Burwell (Mar 23)