RE: spp_portscan and ACID

["Estes, Matt: CPR / FCBS" <Matt.Estes () eis army mil>]

That's because the default logging for spp_portscan doesn't log the packet
info.  I'm new to this list, so don't let me reinvent the wheel here.  I had
to mod the spp_portscan.c file to support basic portscan logging to a
database.

 - Removed the IP/time/host information from the event header that generates
unique events for every portscan you see.
 - Changed event logging to Log and not the default of Alert so that it
works like other database event loggers.
 - Added packet logging (replace NULL with "p" in the logger call)

This is not pretty yet and only shows my the indication of a portscan with 1
packet of info, still working on making it more complete.

Again, has this already been done?

Matt

-----Original Message-----
From: Jason Yates [mailto:jyates () dataservice org]
Sent: Monday, April 01, 2002 3:23 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] spp_portscan and ACID


In ACID, I get warned of portscan scan events like this.

spp_portscan: End of portscan from 10.165.21.21: TOTAL time(14s)
hosts(41) TCP(1) UDP(43)

For some reason, when I click to see the event I can't see whom
10.165.21.21 is scanning.  If I check the portscan.log file.  I have
logs like this

Apr  1 14:38:58 10.165.21.21:1052 -> 10.217.5.32:38293 UDP  
Apr  1 14:38:58 10.165.21.21:1052 -> 10.217.5.76:38293 UDP

How can I get those events to show up in ACID?


-Jason Yates


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users