Snort & portscans in a proxied environment

["Cloppert, Michael" <Michael.Cloppert () 53 com>]

I'm looking for ideas on how to keep snort's portscan2 preprocessor from
triggering on responses to my proxy server.  Over half of the portscans I
get are things like:

src: some.web.server.outthere dst: my.pos.proxy.server sport: 80 dport:
some_ephemeral_port

It's obvious to me that these requests are responses to requests my proxy
made on behalf of its clients.  Adding my.po.proxy.server to
portscan2-ignorehosts obviously doesn't do much good, since it's not the
source, after all.  The only thing I can think of is a daily purge of this
sort of data from my portscan.log file.

I can't be the only one in the world seeing this... anyone have any
solutions that can help me out?  Anything would be appreciated.

Cheers,
Mike


-------------------------------------------------------
This sf.net email is sponsored by: 
Battle your brains against the best in the Thawte Crypto 
Challenge. Be the first to crack the code - register now: 
http://www.gothawte.com/rd521.html
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users