Re: Preprocessor2

[Matt Kettler <mkettler () evi-inc com>]

At 06:26 PM 10/29/2003, you wrote:
> I've loaded the Preprocessor2 support on Snort 2.0. All seems to be work
> well however I appear to getting a lot of false positives, mostly from
> websites, like: http://cbs.marketwatch.com/avatar.asp
>
> Is there are way to weed out the unwanted?

I assume you mean portscan2 not preprocessor2.

do a kill -USR1 on your snort process and look in syslog.. what's your 
packet drop rate like? if it's over 2% or so you're not going to get good 
results from portscan2.

In general converation and portscan2 are considerable CPU hogs.. they cause 
heavy packet loss on lower-end systems which causes an absurd level of 
false positives.

In my experience, these false positives manifest themselves as a "syn ack 
scan" whenever opening a website with lots of images.. what's happening is 
the CPU load from portscan2 is causing it to wind up missing the outbound 
syn packets, but sees the syn-ack replies... since it never saw the syn, it 
decides that this is part of a scan..

Unfortunately there's not much you can do about it.. either upgrade, or 
drop use of spp_conversation and spp_portscan2.



-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?   SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users