Snort mailing list archives
UDP Portscans Are Not Capture
From: "Grigoris Vidakis" <gvidakis () lab epmhs gr>
Date: Mon, 30 Sep 2002 16:44:54 +0300
Hi! I run snort Version 1.8.3 (Build 88) in linux 7.2 (2.4.17) which alert me for the udp portscans correctly (portscan.log, snort.fast,snort.full) BUT when i run snort Version 1.8.7 (Build 128) in linux 7.3 (2.4.18-3) with the same snort.conf and a snort binary file as the input (-r), captured from 1.8.3, which had alerted me about udp portscans), snort 1.8.7 does not alert the udp portscans!!! Below is the snort.conf which i use for the 2 sensors. var HOME_NET any var EXTERNAL_NET any var SMTP_SERVERS $HOME_NET var HTTP_SERVERS $HOME_NET var SQL_SERVERS $HOME_NET var HTTP_PORTS any preprocessor frag2 preprocessor stream4: detect_scans preprocessor stream4_reassemble preprocessor http_decode: 80 -unicode -cginull preprocessor rpc_decode: 111 preprocessor telnet_decode preprocessor portscan: $HOME_NET 4 3 portscan.log output log_tcpdump: snort.log output alert_full: snort_full output alert_fast: snort_fast does anyone have an idea about what is wrong??
Current thread:
- UDP Portscans Are Not Capture Grigoris Vidakis (Sep 30)
- Re: UDP Portscans Are Not Capture Erek Adams (Sep 30)
- Re: UDP Portscans Are Not Capture Grigoris Vidakis (Sep 30)
- Re: UDP Portscans Are Not Capture Erek Adams (Sep 30)
- Re: UDP Portscans Are Not Capture James Hoagland (Sep 30)
- Re: UDP Portscans Are Not Capture Grigoris Vidakis (Sep 30)
- <Possible follow-ups>
- RE: UDP Portscans Are Not Capture McClure Gammon (Sep 30)
- Re: UDP Portscans Are Not Capture Erek Adams (Sep 30)