Snort mailing list archives
-S switch not always followed?
From: "Michael Scheidell" <scheidell () secnap net>
Date: Mon, 13 Mar 2006 13:53:20 -0500
Tcpdump shows 'nessus_tcp_scanner' scanning ports and using source ip not listed in -S switch. Nessus 2.2.7, FBSD 4.11. Nessus startup nessus -a 127.0.0.1 -S 1.1.1.64,1.1.1.65 -D REAL ip address 1.1.1.133 .64 and .65 are pingable aliases Nessus.rc: built by deseleting all, selecting only nessus_tcp_scanner and ping scan. Under prefs, select tcp ping (built-in) and icmp scan (q 6) Tcpdump shows icmp's being 'sourced' with .64,65, but shows portscanner sourced at .133. ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid0944&bid$1720&dat1642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- -S switch not always followed? Michael Scheidell (Mar 13)