[Snort-devel] [Snort-users] portscan2-ignoreports...anyone get it to work???

Kreimendahl, Chad J Chad.Kreimendahl at ...1167...
Mon Mar 24 07:57:57 EST 2003


It does not work for me even on a very recent build.

-----Original Message-----
From: Jeff Oliveto [mailto:joliveto at ...1869...] 
Sent: Thursday, March 20, 2003 3:16 PM
To: snort-devel at lists.sourceforge.net; snort-sigs at lists.sourceforge.net;
snort-users at lists.sourceforge.net
Subject: [Snort-devel] [Snort-users] portscan2-ignoreports...anyone get
it to work???


Has anyone confirmed that the "preprocessor portscan2-ignoreports: s1 s2
d1 d2" variable works?  

I'm running snort v 1.9.1, and varified that the feature is in the
spp_portscan2.c source.

No matter how I specify the variable in the snort.conf file I can't get
portscan2 to filter on the source or destination ports.  Tried several
different variations and none seem to have an affect (see examples
below).  BTW...the portscan2-ignorehosts variable does work in filtering
on the source address.

If it does work...what is the trick?

======== examples ===============

Preferred configuration:

preprocessor portscan2-ignorehosts: $HOME_NET
preprocessor portscan2-ignoreports: s53 s80 s443 d53 d80 d443
preprocessor portscan2: scanners_max 3200, targets_max 5000,
target_limit 5, port_limit 20, timeout 60

Alternate variations used during troubleshooting....

Removed ignorehosts and filter just on source/destination port...doesn't
work:

#preprocessor portscan2-ignorehosts: $HOME_NET
preprocessor portscan2-ignoreports: s53 s80 s443 d53 d80 d443
preprocessor portscan2: scanners_max 3200, targets_max 5000,
target_limit 5, port_limit 20, timeout 60

Reduce to one source port...doesn't work:

preprocessor portscan2-ignorehosts: $HOME_NET
preprocessor portscan2-ignoreports: s80
preprocessor portscan2: scanners_max 3200, targets_max 5000,
target_limit 5, port_limit 20, timeout 60

Change position...doesn't work:

preprocessor portscan2-ignorehosts: $HOME_NET
preprocessor portscan2: scanners_max 3200, targets_max 5000,
target_limit 5, port_limit 20, timeout 60
preprocessor portscan2-ignoreports: s53 s80 s443 d53 d80 d443

Jeff Oliveto




More information about the Snort-devel mailing list