Re: portscan2-ignore... ???

[Michael D Schleif <mds () helices org>]

Erek Adams <erek () snort org> [2003:08:18:20:20:29-0400] scribed:
> On Sun, 17 Aug 2003, Michael D Schleif wrote:
>
> [...snip...]
>
> > >   snort <options> 'not src host 192.168.123.150'
>
> [...snip...]
>
> > That is *not* what I want to do ;>
>
> Actually it is.  :)

I'm not ready -- yet -- to ignore *everything* originating on
192.168.123.150 ;>

> > As I explained in the original post:
> >
> >    ``What if I want to ignore spp_portscan2 *only* originating from
> >    192.168.123.150?  Suppose that I am very interested in any scans where
> >    192.168.123.150 is the destination/subject of that scan?''
>
> Look at the top line.  It says "not src" which mean show all traffic
> except that which has a SOURCE IP ip of 192.168.123.150.
>
> > Now, I have un-configured portscan[1], and have retested:
> >
> > [1] From 192.168.123.110: nmap -O 192.168.123.150 -- which spews into
> > /var/log/snort/portscan2.log, and gives me spp_portscan2 in
> > /var/log/snort/alert .
> >
> > [2] From 192.168.123.150: nmap -O 192.168.123.110 -- which puts
> > _nothing_ in /var/log/snort/portscan2.log, and _no_ spp_portscan2 in
> > /var/log/snort/alert .
>
> Yes.  Both normal, and working the way you want.
>
> > [3] From 192.168.123.150: nmap -O localhost -- which puts _nothing_ in
> > /var/log/snort/portscan2.log, and _no_ spp_portscan2 in
> > /var/log/snort/alert .
>
> Normal.  Localhost is 127.0.0.1 not 192.168.123.150.
>
> > So, I guess my confusion was whether or not *ALL* scans of
> > 192.168.123.150, originating somewhere other than 192.168.123.150, would
> > result in spp_portscan2 alerts?  Apparently, as I desire, that is the
> > case.
> >
> > Have I missed anything?  If not, case closed and thank you for
> > clarification . . .
>
> I think that should get you going.

Yes, I am now clear what snort is doing in this scenario.  Although, I
may have issues with the debian-specific package and its reporting
mechanism, those I will take up with debian.

Thank you, for your consideration and follow through . . .

-- 
Best Regards,

mds
-
Dare to fix things before they break . . .
-
Our capacity for understanding is inversely proportional to how much
we think we know.  The more I know, the more I know I don't know . . .
--

Attachment: _bin
Description: