Flow-portscan

[Jochen Vogel <jvogel () it-sec de>]

Hi,

I tested flow-portscan.
Is it normal that snort detect a "scanner limit" only that the
server-learning-time is exceeded.

If i set server-learning-time to 360 and scan from a client to the server it
get the
5min "Talker Limits" and after this time "Scanner Limits"

If this is normal and i use the default value 28800 i will get 8 hours
"Talker Limits" instead of "Scanner Limits"?

Which sense make the sliding scale?

Thx for info
jo


-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users