[Snort-devel] New scan detection plugin

snort at ...2073... snort at ...2073...
Sat Jul 5 06:50:04 EDT 2003


Visit this website to read about a new scan plugin:
http://rjs3.com/snortping

Overview:
This plugin is geared toward Snort being used as an internet IDS. The
idea that turned into SnortPing is based upon packets destined for down
hosts. In a perfect network, this would never occur.  In real life, it
occurs all the time.  Examples of this activity include misconfigured
DNS settings, IP typos, crashed servers, or scanning.  SnortPing aims to
discover those people scanning. Visit for website for the details and
code.

Rob





More information about the Snort-devel mailing list