Re: spp_portscan to port 80

[Nicky Davey <daveyn2002 () yahoo com au>]

Thanks, i did have my home net set to any.

So why would it think port 80 traffic is a port scan?

 --- Paul Keser <pkeser () mail arc nasa gov> wrote: >
-----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> I saw a lot of these types of alerts until I defined
> my HOME_NET variable.
>
> - -PaulK
>
>
> On Thursday 21 February 2002 08:48, you wrote:
> > Hi,
> >
> > I have set up snort and my portscan.log file is
> full
> > of spp_portscans from my internal addresses to
> outside
> > addresses on port 80. I put this down to normal
> http
> > traffic, is it normal and why does it happen?
> >
> > Thank you.
> >
> > http://movies.yahoo.com.au - Yahoo! Movies
> > - Vote for your nominees in our online Oscars
> pool.
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or
> unsubscribe:
> >
https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
iD8DBQE8dTR6txLIMhQSDIERAmdyAKCTz9imEulaPDXz6HuyiqDda3vuhgCgm2FC
> pQfLH/pY6RYcTAH9r7V+4pA=
> =UpHf
> -----END PGP SIGNATURE----- 

http://movies.yahoo.com.au - Yahoo! Movies
- Vote for your nominees in our online Oscars pool.

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users