Snort mailing list archives
Re: Interesting entries in BASE
From: CasperLinux <CasperLinux () comcast net>
Date: Sun, 26 Feb 2006 19:24:18 -0500
On Sunday 26 February 2006 18:59, you wrote:
That entry is from the sfportscan preprocessor. You can enable, tune, or disable this preprocessor via your snort.conf
Ok but why did it suddenly decide to kick itself on? I have had every rule turned on for the better part of a week and this is the first day I noticed it. I did a check and I have three hits on a portscan (1 Saturday and 2 today) and 15 open port checks (all today in about a 2 minute timeframe). This seems to be something that got triggered somehow.
Joel
Don - Powered by Debian Linux - ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Interesting entries in BASE CasperLinux (Feb 26)
- Re: Interesting entries in BASE Joel Esler (Feb 26)
- Re: Interesting entries in BASE CasperLinux (Feb 26)
- Re: Interesting entries in BASE Joel Esler (Feb 26)