[Snort-devel] New scan detection plugin

Rob Settle settle at ...2073...
Tue Jul 8 13:25:06 EDT 2003


Visit this website to read about a new scan plugin:
http://rjs3.com/snortping

This plugin is geared toward Snort being used as an internet IDS.
The idea that turned into SnortPing is based upon packets destined for
down hosts.
In a perfect network, this would never occur.  In real life, it occurs
all the
time.  Examples of this activity include misconfigured DNS settings, IP
typos,
crashed servers, or scanning.  SnortPing aims to discover those people
scanning.
Visit for website for the details and code.

Rob





More information about the Snort-devel mailing list