Snort mailing list archives
RE: RE: No portscan still on ACID
From: "Michael Steele" <michaels () winsnort com>
Date: Tue, 9 Mar 2004 22:16:38 -0800
OK, I was not receiving portscans with 2.1.0, but I'm now receiving portscans with 2.1.1. My snort.conf contains: preprocessor portscan: $HOME_NET 4 3 <FULL_PATH>\log\portscan.log This works for me. Mar 8 03:59:45 69.56.144.70:20 -> X.X.X.X:2683 SYN ******S* Mar 8 03:59:45 69.56.144.70:20 -> X.X.X.X:2684 SYN ******S* Mar 8 03:59:46 69.56.144.70:20 -> X.X.X.X:2685 SYN ******S* Mar 8 03:59:47 69.56.144.70:20 -> X.X.X.X:2686 SYN ******S* Mar 8 03:59:48 69.56.144.70:20 -> X.X.X.X:2687 SYN ******S* Mar 8 06:59:43 69.56.144.70:20 -> X.X.X.X:3620 SYN ******S* Mar 8 06:59:44 69.56.144.70:20 -> X.X.X.X:3621 SYN ******S* Mar 8 06:59:45 69.56.144.70:20 -> X.X.X.X:3622 SYN ******S* Mar 8 06:59:45 69.56.144.70:20 -> X.X.X.X:3623 SYN ******S* Mar 8 06:59:46 69.56.144.70:20 -> X.X.X.X:3624 SYN ******S* Kindest regards, The WINSNORT.com Management Team -- Pick up your FREE Windows or UNIX Snort installation guides mailto:support () winsnort com Website: http://www.winsnort.com Snort: Open Source Network IDS - http://www.snort.org
-----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users- admin () lists sourceforge net] On Behalf Of James Chong Sent: Tuesday, March 09, 2004 9:00 PM To: snort-users () lists sourceforge net Subject: [Snort-users] RE: No portscan still on ACID I am a bit frustrated after doing this and still no port scan.I do not know what is wrong.I have done: 1. Configured snort.etc var HOME_NET 202.185.109.165/32,202.185.109.170/32,202.185.109.171/32,202.185.109.172/3 2 preprocessor portscan: $HOME_NET 4 3 /var/log/snort/portscan.log (Is portscan.log created automatically or must I create a blank one?) 2. Changed it to alert: output database: alert, mysql, ... 3. Changed acid_conf.php /* Snort spp_portscan log file */ $portscan_file = "/var/log/snort/portscan.log"; I tried port scanning using LanGuard 2.0 and nmapwin 1.3.1. But still there is no portscan.log file and data. Am I missing something here? Hope someone can advise. Thanks for the help.Appreciate it James __________________________________ Do you Yahoo!? Yahoo! Search - Find what youre looking for faster http://search.yahoo.com ------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Portscan traffic on ACID James Chong (Mar 09)
- Re: Portscan traffic on ACID James Chong (Mar 09)
- Re: Portscan traffic on ACID James Chong (Mar 09)
- RE: No portscan still on ACID James Chong (Mar 09)
- RE: RE: No portscan still on ACID Michael Steele (Mar 09)