Snort mailing list archives
RE: flow-portscan really suitable ???
From: "Douglas McCrea" <dmccrea () rutgers edu>
Date: Thu, 4 Mar 2004 11:39:35 -0500
You can still use Portscan2 thankfully by just copying back the sections from an old config. I have to agree here about flow-portscan. Portscan2 works nicely for me an rarely shows false positives. I still haven't seen anything from flow-portscan besides false positives and considering that- even when it shows the false positives, it doesn't report any useful data (with msg or pktkludge). I've also only seen responses from people saying, "Use pktkludge, it's in the documentation." Well, I have, and it still doesn't produce any useful data anywhere that I can see no matter what settings I put for anything. My question is this... Is anyone using flow-portscan effectively and getting results such that you can see that a system is scanning your hosts for port 25, etc.? If so, can you post your settings for this? Neither myself nor my colleagues who have used Snort for years have been able to get this to work at all. We are all concerned that portscan2 will be removed, and then we will no longer be able to see any scanning activity using Snort. -Doug -----Original Message----- From: BIZOU [mailto:bizou () voila fr] Sent: Thursday, March 04, 2004 11:10 AM To: snort-users () lists sourceforge net Subject: [Snort-users] flow-portscan really suitable ??? Hi, I've been working on snort 2.1.1 for a few days. I was previously with snort 2.0.5. I had to change my portscan2 configuration into flow-portscan and ... well i dislike it Indeed, i tuned my portscan2 preprocessor with scanner-max 256, target_max 1024, target_limit 30, port_limit 40, timeout 40 and it was quite fine. I used portscan2-ignorehost and ignore-port too. I catched MydoomB scans, Blaster.C or B (don't remember) scans, nmap scan.... Now with flow-portscan, i have nothing except flase positive scans I'm managing 6 NIDS in a wide environment so i cannot define a HOME_NET or wathever defined variable When i watched at my prelude reporting GUI this morning (i use a prelude framework for alerting) i only saw false scan alerts. I tried to configure flow-portscan in several way, i cannot succeed in having correct results So please, 1 - tell me that it wil be possible again to use portscan2 in future releases 2 - Tell me a way to configure correctly and simply flow-portscan (without a learning time ) 3 - Tell me a way to add flow-portscan ignore port from 4 - Tell me that destination port will be present in pktkludge soon ------------------------------------------ Faites un voeu et puis Voila ! www.voila.fr ------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- flow-portscan really suitable ??? BIZOU (Mar 04)
- <Possible follow-ups>
- RE: flow-portscan really suitable ??? Douglas McCrea (Mar 04)
- Re: RE: flow-portscan really suitable ??? BIZOU (Mar 04)
- RE: RE: flow-portscan really suitable ??? Douglas McCrea (Mar 04)
- Re: RE: RE: flow-portscan really suitable ??? BIZOU (Mar 05)
- Re: RE: RE: flow-portscan really suitable ??? Jeremy Hewlett (Mar 05)