Snort mailing list archives
RE: [Snort-sigs] portscan2-ignoreports...anyone get it to work???
From: "Kevin Riggins" <kevin.riggins () comdev com>
Date: Fri, 21 Mar 2003 07:54:41 -0600
The ignore hosts statement needs to be after the portscan2 statement like so: preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit 5, port_limit 20, timeout 60 preprocessor portscan2-ignorehosts: $HOME_NET preprocessor portscan2-ignoreports: s53 s80 s443 d53 d80 d443 Kevin -----Original Message----- From: Jeff Oliveto [mailto:joliveto () CleanCommunications com] Sent: Thursday, March 20, 2003 3:16 PM To: snort-devel () lists sourceforge net; snort-sigs () lists sourceforge net; snort-users () lists sourceforge net Subject: [Snort-sigs] portscan2-ignoreports...anyone get it to work??? Has anyone confirmed that the "preprocessor portscan2-ignoreports: s1 s2 d1 d2" variable works? I'm running snort v 1.9.1, and varified that the feature is in the spp_portscan2.c source. No matter how I specify the variable in the snort.conf file I can't get portscan2 to filter on the source or destination ports. Tried several different variations and none seem to have an affect (see examples below). BTW...the portscan2-ignorehosts variable does work in filtering on the source address. If it does work...what is the trick? ======== examples =============== Preferred configuration: preprocessor portscan2-ignorehosts: $HOME_NET preprocessor portscan2-ignoreports: s53 s80 s443 d53 d80 d443 preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit 5, port_limit 20, timeout 60 Alternate variations used during troubleshooting.... Removed ignorehosts and filter just on source/destination port...doesn't work: #preprocessor portscan2-ignorehosts: $HOME_NET preprocessor portscan2-ignoreports: s53 s80 s443 d53 d80 d443 preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit 5, port_limit 20, timeout 60 Reduce to one source port...doesn't work: preprocessor portscan2-ignorehosts: $HOME_NET preprocessor portscan2-ignoreports: s80 preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit 5, port_limit 20, timeout 60 Change position...doesn't work: preprocessor portscan2-ignorehosts: $HOME_NET preprocessor portscan2: scanners_max 3200, targets_max 5000, target_limit 5, port_limit 20, timeout 60 preprocessor portscan2-ignoreports: s53 s80 s443 d53 d80 d443 Jeff Oliveto
Current thread:
- RE: [Snort-sigs] portscan2-ignoreports...anyone get it to work??? Kevin Riggins (Mar 21)