Fw: [Snort-devel] Call for features requests for SPPv2
larsjaso at ...282...
Tue May 15 14:40:24 EDT 2001
----- Original Message -----
From: "Jason Larsen" <larsjaso at ...282...>
To: "Patrick Mullen" <pmullen at ...43...>
Sent: Tuesday, May 15, 2001 12:38 PM
Subject: Re: [Snort-devel] Call for features requests for SPPv2
> I'd like to see the portscan preprocessor based on only unsolisited
> instead of all packets. I
> have some test code that finds unsolisited packets I can probably clean
> It would allow people to
> set a much lower trigger without so many false alarms.
> Also what would be nice would be to find a way to categorized the scan in
> the alert such as FIN scan accross port 21, SYN scan on machine
> etc. Some idea of the speed of the scan would be nice too.
> Jason Larsen
> larsjaso at ...283...
> ----- Original Message -----
> From: "Patrick Mullen" <pmullen at ...43...>
> To: <snort-users at lists.sourceforge.net>;
<snort-devel at lists.sourceforge.net>
> Sent: Tuesday, May 15, 2001 1:16 AM
> Subject: [Snort-devel] Call for features requests for SPPv2
> > The grapevine was properly seeded for me to catch wind that The Big Guy
> (TM) wants
> > a new version of the Snort Portscan Preprocessor out and he wants it
> yesterday. ;)
> > Make your voice heard! Tell me what you like and don't like about the
> > SPP and what features you feel are lacking. No request is too large and
> > request is too small. I take all requests and comments! It doesn't
> > implement them all, but I do take them...
> > Just please reply to me directly; feel free to cc: the list if you'd
> I get
> > too much mail to too many lists to pore through it all.
> > Thanks,
> > ~Patrick
> > _______________________________________________
> > Snort-devel mailing list
> > Snort-devel at lists.sourceforge.net
> > http://lists.sourceforge.net/lists/listinfo/snort-devel
More information about the Snort-devel