Snort mailing list archives
Re: [Snort-devel] portscan events not showing up in base
From: John Newman <jnn () webii net>
Date: Tue, 23 May 2006 12:05:16 -0500
Oh, looks like this is for for flow-portscan, which I'm not using. Maybe I should? How does it compare to sfportscan and portscan2 in people's experience? -- John On Tue, May 23, 2006 at 11:53:32AM -0500, John Newman wrote:
I'm not familiar with this option, or even where this option would go... could you give me more info? thanks! -- John On Tue, May 23, 2006 at 12:08:41PM -0400, Eric Lauzon wrote:Do you use the option: output-mode pktkludge ?? Eric Lauzon [Recherche & D?veloppement] Above S?curit? / Above Security T?l : (450) 430-8166 Fax : (450) 430-1858 --------------------------------------- "Premature optimization is the root of all evil (or at least most of it) in programming." - Donald Knuth-----Original Message----- From: snort-devel-admin () lists sourceforge net [mailto:snort-devel-admin () lists sourceforge net] On Behalf Of John Newman Sent: 23 mai 2006 12:06 To: snort-users () lists sourceforge net; snort-devel () lists sourceforge net Subject: [Snort-devel] portscan events not showing up in base Hello, I'm using snort 2.4.4 but not sfportscan, rather the older portscan and portscan2 modules. I've just realized that, although portscans are being detected just fine, they aren't being propagated through barnyard into the base database. e.g. select * from acid_event where sig_name like '%portscan%' and timestamp > '2006-05-01 00:00:00'; returns nothing If I change the date portion to sometime last month, before I switched from sfportscan, I get all sorts of results. Does anyone have any clue what might be causing this? thanks, -- John Newman Systems Administrator, WebXess Inc. ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057& dat=121642 _______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-develAVERTISSEMENT CONCERNANT LA CONFIDENTIALIT? Le pr?sent message est ? l'usage exclusif du ou des destinataires mentionn?s ci-dessus. Son contenu est confidentiel et peut ?tre assujetti au secret professionnel. Si vous avez re?u le pr?sent message par erreur, veuillez nous en aviser imm?diatement et le d?truire en vous abstenant d'en faire une copie, d'en divulguer le contenu ou d'y donner suite. CONFIDENTIALITY NOTICE This communication is intended for the exclusive use of the addressee identified above. Its content is confidential and may contain privileged information. If you have received this communication by error, please notify the sender and delete the message without copying or disclosing it. ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642 _______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel-- John Newman Systems Administrator, WebXess Inc. ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642 _______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel
-- John Newman Systems Administrator, WebXess Inc. ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- RE: [Snort-devel] portscan events not showing up in base Eric Lauzon (May 25)
- Re: [Snort-devel] portscan events not showing up in base John Newman (May 23)
- Re: [Snort-devel] portscan events not showing up in base John Newman (May 23)
- Re: [Snort-devel] portscan events not showing up in base John Newman (May 23)
- Re: Re: [Snort-devel] portscan events not showing up in base John Newman (May 23)
- Re: Re: [Snort-devel] portscan events not showing up in base Joel Esler (May 23)
- Re: [Snort-devel] portscan events not showing up in base John Newman (May 23)
- Re: [Snort-devel] portscan events not showing up in base John Newman (May 23)