Snort mailing list archives
Re: portscan2-ignorehosts & portscan-ignorehosts
From: Robby Desmond <rdesmond () els ucsb edu>
Date: Mon, 02 Dec 2002 11:22:06 -0800
At 01:37 PM 12/2/2002 -0800, Alberto Gonzalez wrote:
Your alert came from spp_portscan, add the following to that line: preprocessor portscan-ignorehosts: 24.167.76.32/32
Umm, the actual problem is that his portscan-ignorehosts needs to be *after* his initial portscan line.
Or the following for spp_portscan2 preprocessor portscan2-ignorehosts: 34.167.76.32/32 Why are you using both spp_portscan and spp_portscan2 ?
Yeah. That is a good question. Why?
Cheers! - Alberto Distribution Lists wrote:I have this in my snort.conf preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit 5, port_limit 20, timeout 60 preprocessor portscan-ignorehosts: 24.167.76.32 preprocessor portscan: $HOME_NET 4 3 portscan.log preprocessor portscan2-ignorehosts: 24.167.76.32 but I still getting [**] [100:1:1] spp_portscan: PORTSCAN DETECTED from 24.167.76.32 (THRESHOLD 4 connections exceeded in 0 seconds) [**] So any ideas what I have missed ? Regards-- The secret to success is to start from scratch and keep on scratching. -------------------------------------------------------This SF.net email is sponsored by: Get the new Palm Tungsten T handheld. Power & Color in a compact size! http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Robert Desmond Systems Administrator UCSB Extended Learning Services 805-893-4906 -------------------------------------------------------This SF.net email is sponsored by: Get the new Palm Tungsten T handheld. Power & Color in a compact size! http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- portscan2-ignorehosts & portscan-ignorehosts Distribution Lists (Dec 02)
- Re: portscan2-ignorehosts & portscan-ignorehosts Alberto Gonzalez (Dec 02)
- Re: portscan2-ignorehosts & portscan-ignorehosts Distribution Lists (Dec 02)
- Re: portscan2-ignorehosts & portscan-ignorehosts Robby Desmond (Dec 02)
- Re: portscan2-ignorehosts & portscan-ignorehosts Alberto Gonzalez (Dec 02)