Re: Re: [Snort-devel] portscan events not showing up in base

[Joel Esler <joel.esler () sourcefire com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

BASE can't read < sfportscan.  It never could.  (its a bug inherited
from ACID)

Use sfportscan, it logs to db.

Joel

John Newman wrote:
> Didn't seem to do the trick...   anyone have any other ideas?   
>
> Also, I tried switching it from portscan2.log to portscan.log,
> rebuilding my alert cache in base, a few other things... still can't get
> portscans to show up.
>
> thanks
> --
>
> John
>
> On Tue, May 23, 2006 at 12:25:55PM -0500, John Newman wrote:
> > Could this be the answer to my problem:
> >
> > base_conf.php has this setting, which I just set:
> >
> > /* Snort spp_portscan log file */
> > $portscan_file = '/var/log/snort/portscan2.log';
> >
> > Maybe this will do the trick!
> >
> > On Tue, May 23, 2006 at 12:05:16PM -0500, John Newman wrote:
> > > Oh, looks like this is for for flow-portscan, which I'm not using.
> > > Maybe I should?   How does it compare to sfportscan and portscan2 in
> > > people's experience?
> > >
> > > --
> > > John
> > >
> > > On Tue, May 23, 2006 at 11:53:32AM -0500, John Newman wrote:
> > > > I'm not familiar with this option, or even where this option would go...
> > > > could you give me more info?  
> > > >
> > > > thanks!
> > > >
> > > > --
> > > > John
> > > >
> > > > On Tue, May 23, 2006 at 12:08:41PM -0400, Eric Lauzon wrote:
> > > > > Do you use
> > > > > the option:
> > > > >  output-mode pktkludge 
> > > > > ??
> > > > >
> > > > >
> > > > >
> > > > > Eric Lauzon
> > > > > [Recherche & D?veloppement]
> > > > > Above S?curit? / Above Security
> > > > > T?l  : (450) 430-8166
> > > > > Fax : (450) 430-1858 
> > > > >
> > > > > ---------------------------------------
> > > > > "Premature optimization is the root of all
> > > > > evil (or at least most of it) in programming."
> > > > > - Donald Knuth
> > > > >  
> > > > >
> > > > > > -----Original Message-----
> > > > > > From: snort-devel-admin () lists sourceforge net 
> > > > > > [mailto:snort-devel-admin () lists sourceforge net] On Behalf Of 
> > > > > > John Newman
> > > > > > Sent: 23 mai 2006 12:06
> > > > > > To: snort-users () lists sourceforge net; 
> > > > > > snort-devel () lists sourceforge net
> > > > > > Subject: [Snort-devel] portscan events not showing up in base
> > > > > >
> > > > > > Hello,
> > > > > >
> > > > > > I'm using snort 2.4.4 but not sfportscan, rather the older 
> > > > > > portscan and
> > > > > > portscan2 modules.  I've just realized that, although 
> > > > > > portscans are being detected just fine, they aren't being 
> > > > > > propagated through barnyard into the base database.  
> > > > > >
> > > > > > e.g.
> > > > > >
> > > > > > select * from acid_event where sig_name like '%portscan%' and 
> > > > > > timestamp >
> > > > > > '2006-05-01 00:00:00';
> > > > > >
> > > > > > returns nothing
> > > > > >
> > > > > > If I change the date portion to sometime last month, before I switched
> > > > > > from sfportscan, I get all sorts of results.   Does anyone 
> > > > > > have any clue
> > > > > > what might be causing this?
> > > > > >
> > > > > > thanks,
> > > > > >
> > > > > > --
> > > > > > John Newman
> > > > > > Systems Administrator, WebXess Inc.
> > > > > >
> > > > > >
> > > > > > -------------------------------------------------------
> > > > > > Using Tomcat but need to do more? Need to support web 
> > > > > > services, security?
> > > > > > Get stuff done quickly with pre-integrated technology to make 
> > > > > > your job easier
> > > > > > Download IBM WebSphere Application Server v.1.0.1 based on 
> > > > > > Apache Geronimo
> > > > > > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&;
> > > > > > dat=121642
> > > > > > _______________________________________________
> > > > > > Snort-devel mailing list
> > > > > > Snort-devel () lists sourceforge net
> > > > > > https://lists.sourceforge.net/lists/listinfo/snort-devel
> > > > > AVERTISSEMENT CONCERNANT LA CONFIDENTIALIT? 
> > > > >
> > > > > Le pr?sent message est ? l'usage exclusif du ou des destinataires mentionn?s ci-dessus. Son contenu est 
> > > > > confidentiel et peut ?tre assujetti au secret professionnel. Si vous avez re?u le pr?sent message par erreur, 
> > > > > veuillez nous en aviser imm?diatement et le d?truire en vous abstenant d'en faire une copie, d'en divulguer le 
> > > > > contenu ou d'y donner suite.
> > > > >
> > > > > CONFIDENTIALITY NOTICE
> > > > >
> > > > > This communication is intended for the exclusive use of the addressee identified above. Its content is 
> > > > > confidential and may contain privileged information. If you have received this communication by error, please 
> > > > > notify the sender and delete the message without copying or disclosing it.
> > > > >
> > > > >
> > > > > -------------------------------------------------------
> > > > > Using Tomcat but need to do more? Need to support web services, security?
> > > > > Get stuff done quickly with pre-integrated technology to make your job easier
> > > > > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> > > > > http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
> > > > > _______________________________________________
> > > > > Snort-devel mailing list
> > > > > Snort-devel () lists sourceforge net
> > > > > https://lists.sourceforge.net/lists/listinfo/snort-devel
> > > > -- 
> > > > John Newman
> > > > Systems Administrator, WebXess Inc.
> > > >
> > > >
> > > > -------------------------------------------------------
> > > > Using Tomcat but need to do more? Need to support web services, security?
> > > > Get stuff done quickly with pre-integrated technology to make your job easier
> > > > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> > > > http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
> > > > _______________________________________________
> > > > Snort-devel mailing list
> > > > Snort-devel () lists sourceforge net
> > > > https://lists.sourceforge.net/lists/listinfo/snort-devel
> > > -- 
> > > John Newman
> > > Systems Administrator, WebXess Inc.
> > >
> > >
> > > -------------------------------------------------------
> > > Using Tomcat but need to do more? Need to support web services, security?
> > > Get stuff done quickly with pre-integrated technology to make your job easier
> > > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> > > http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
> > > _______________________________________________
> > > Snort-devel mailing list
> > > Snort-devel () lists sourceforge net
> > > https://lists.sourceforge.net/lists/listinfo/snort-devel
> > -- 
> > John Newman
> > Systems Administrator, WebXess Inc.
> >
> >
> > -------------------------------------------------------
> > All the advantages of Linux Managed Hosting--Without the Cost and Risk!
> > Fully trained technicians. The highest number of Red Hat certifications in
> > the hosting industry. Fanatical Support. Click to learn more
> > http://sel.as-us.falkag.net/sel?cmd=lnk&kid7521&bid$8729&dat1642
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEc0wvKbCSyXHckt4RAjRfAJ9zy7LVO+ZuhK+QJa/h9bnsp4e01wCeLu8v
mU4WPRyhqVABn4PQtgg6dQk=
=8fp6
-----END PGP SIGNATURE-----


-------------------------------------------------------
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users