Snort mailing list archives
portscan preprocessor and external net
From: marco turr <marco_syslnx () yahoo it>
Date: Tue, 29 Nov 2005 15:10:21 +0100 (CET)
Hi, I have a problem with portscan preprocessor. I need to detect scan from $home -> $home and scan from $home -> any. I see that in sfportscan and flow-portscan preprocessor there are options like src-ignore-net or ignore-scanners. Now if i set one of this options at $EXTERNAL_NET (where EXTERNAL_NET is !$HOME_NET) i get an error. How can i resolve this? Thanks a lot --------------------------------- Yahoo! Mail: gratis 1GB per i messaggi, antispam, antivirus, POP3
Current thread:
- portscan preprocessor and external net marco turr (Nov 29)
- Re: portscan preprocessor and external net Jason Brvenik (Nov 29)
- Re: portscan preprocessor and external net marco turr (Nov 29)
- Re: portscan preprocessor and external net Matt Kettler (Nov 29)
- Re: portscan preprocessor and external net marco turr (Nov 29)
- Re: portscan preprocessor and external net marco turr (Nov 29)
- Re: portscan preprocessor and external net Jason Brvenik (Nov 29)