RE: [Snort-devel] portscan events not showing up in base

["Eric Lauzon" <eric.lauzon () abovesecurity com>]

Do you use
the option:
 output-mode pktkludge 
??



Eric Lauzon
[Recherche & Développement]
Above Sécurité / Above Security
Tél  : (450) 430-8166
Fax : (450) 430-1858 

---------------------------------------
"Premature optimization is the root of all
evil (or at least most of it) in programming."
- Donald Knuth
 

> -----Original Message-----
> From: snort-devel-admin () lists sourceforge net 
> [mailto:snort-devel-admin () lists sourceforge net] On Behalf Of 
> John Newman
> Sent: 23 mai 2006 12:06
> To: snort-users () lists sourceforge net; 
> snort-devel () lists sourceforge net
> Subject: [Snort-devel] portscan events not showing up in base
>
> Hello,
>
> I'm using snort 2.4.4 but not sfportscan, rather the older 
> portscan and
> portscan2 modules.  I've just realized that, although 
> portscans are being detected just fine, they aren't being 
> propagated through barnyard into the base database.  
>
> e.g.
>
> select * from acid_event where sig_name like '%portscan%' and 
> timestamp >
> '2006-05-01 00:00:00';
>
> returns nothing
>
> If I change the date portion to sometime last month, before I switched
> from sfportscan, I get all sorts of results.   Does anyone 
> have any clue
> what might be causing this?
>
> thanks,
>
> --
> John Newman
> Systems Administrator, WebXess Inc.
>
>
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web 
> services, security?
> Get stuff done quickly with pre-integrated technology to make 
> your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on 
> Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&;
> dat=121642
> _______________________________________________
> Snort-devel mailing list
> Snort-devel () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-devel

AVERTISSEMENT CONCERNANT LA CONFIDENTIALITÉ 

Le présent message est à l'usage exclusif du ou des destinataires mentionnés ci-dessus. Son contenu est confidentiel et 
peut être assujetti au secret professionnel. Si vous avez reçu le présent message par erreur, veuillez nous en aviser 
immédiatement et le détruire en vous abstenant d'en faire une copie, d'en divulguer le contenu ou d'y donner suite.

CONFIDENTIALITY NOTICE

This communication is intended for the exclusive use of the addressee identified above. Its content is confidential and 
may contain privileged information. If you have received this communication by error, please notify the sender and 
delete the message without copying or disclosing it.


-------------------------------------------------------
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd=lnk&kid7521&bid$8729&dat1642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users