Snort mailing list archives
Re: portscan2-ignore... ???
From: Erek Adams <erek () snort org>
Date: Mon, 18 Aug 2003 20:20:29 -0400 (EDT)
On Sun, 17 Aug 2003, Michael D Schleif wrote: [...snip...]
snort <options> 'not src host 192.168.123.150'
[...snip...]
That is *not* what I want to do ;>
Actually it is. :)
As I explained in the original post: ``What if I want to ignore spp_portscan2 *only* originating from 192.168.123.150? Suppose that I am very interested in any scans where 192.168.123.150 is the destination/subject of that scan?''
Look at the top line. It says "not src" which mean show all traffic except that which has a SOURCE IP ip of 192.168.123.150.
Now, I have un-configured portscan[1], and have retested: [1] From 192.168.123.110: nmap -O 192.168.123.150 -- which spews into /var/log/snort/portscan2.log, and gives me spp_portscan2 in /var/log/snort/alert . [2] From 192.168.123.150: nmap -O 192.168.123.110 -- which puts _nothing_ in /var/log/snort/portscan2.log, and _no_ spp_portscan2 in /var/log/snort/alert .
Yes. Both normal, and working the way you want.
[3] From 192.168.123.150: nmap -O localhost -- which puts _nothing_ in /var/log/snort/portscan2.log, and _no_ spp_portscan2 in /var/log/snort/alert .
Normal. Localhost is 127.0.0.1 not 192.168.123.150.
So, I guess my confusion was whether or not *ALL* scans of 192.168.123.150, originating somewhere other than 192.168.123.150, would result in spp_portscan2 alerts? Apparently, as I desire, that is the case. Have I missed anything? If not, case closed and thank you for clarification . . .
I think that should get you going. Cheers! ----- Erek Adams "When things get weird, the weird turn pro." H.S. Thompson ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- portscan2-ignore... ??? Michael D Schleif (Aug 15)
- Re: portscan2-ignore... ??? Michael D Schleif (Aug 16)
- Re: portscan2-ignore... ??? Erek Adams (Aug 17)
- Re: portscan2-ignore... ??? Michael D Schleif (Aug 17)
- Re: portscan2-ignore... ??? Michael D Schleif (Aug 18)
- Re: portscan2-ignore... ??? Erek Adams (Aug 18)
- Re: portscan2-ignore... ??? Michael D Schleif (Aug 18)
- Re: portscan2-ignore... ??? Erek Adams (Aug 19)
- Re: portscan2-ignore... ??? Erek Adams (Aug 17)
- Re: portscan2-ignore... ??? Michael D Schleif (Aug 16)
- Re: portscan2-ignore... ??? Erek Adams (Aug 18)
- Re: portscan2-ignore... ??? Michael D Schleif (Aug 18)