Re: portscan events not showing up in base

[Joel Esler <joel.esler () sourcefire com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

What is your portscan line from your snort.conf file?

Joel

John Newman wrote:
> Hello,
>
> I'm using snort 2.4.4 but not sfportscan, rather the older portscan and
> portscan2 modules.  I've just realized that, although portscans are
> being detected just fine, they aren't being propagated through barnyard
> into the base database.  
>
> e.g.
>
> select * from acid_event where sig_name like '%portscan%' and timestamp >
> '2006-05-01 00:00:00';
>
> returns nothing
>
> If I change the date portion to sometime last month, before I switched
> from sfportscan, I get all sorts of results.   Does anyone have any clue
> what might be causing this?
>
> thanks,

- --
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEczNBKbCSyXHckt4RAqruAKCmakaXNUM6eLp+AknGUyXiXffhAgCeO6OI
KYB1aZzD/x8WBjH/RXSrWJE=
=Eu41
-----END PGP SIGNATURE-----


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users