Re: port scans

[Jose Maria Lopez <jkerouac () bgsec com>]

El lun, 27 de 12 de 2004 a las 15:38, Sidharth Deshpande escribió:
> Hello team,
>  
> I am running snort on a test network. I was interested to know if
> snort can detect port scans that are extremely slow. Port scans that
> span over a few days for example.
>  
> Is there a way for snort to identify this kind of scan?
>  

I think it depends on the kind of scan. Snort can detect some
kind of scans like the ones you can do with nmap even if it's
just a single packet. But if someone it's portscanning you and
taking days to do so they probably use UDP or TCP perfectly
"legal" packets or connections, that snort probably won't see.

The best way to log this kind of scans it's to have rules
(you can use iptables or snort) that logs packets in ports that
aren't running any server. That will give you the hint that
someone it's portscanning you and not just trying to use your
services.

> I hope you could help me out with this information.
>  
> Thanks
>  
> Sidharth Deshpande
>
>
> ______________________________________________________________________
> Do you Yahoo!?
> Take Yahoo! Mail with you! Get it on your mobile phone.

-- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac () bgsec com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users