[Snort-users] Multiple networks and port-scanning...

Christian Hammers ch at ...139...
Wed Jul 26 12:15:06 EDT 2000


On Wed, Jul 26, 2000 at 12:09:13PM -0400, Christopher Cramer wrote:
> Clever!  But any thoughts on how you would know which machine was under
> attack?
Surely, just renumber them, making 
 212.110.123.0/24 -> 10.1.0.0/24 and
 194.66.25.0/19   -> 10.2.0.0/19 etc.
and match for 10.0.0.0/8.

If you actually write such a renumber preprocessor, please post it to 
the list!

> -Chris
bye,

 -christian-

-- 
Christian Hammers    WESTEND GmbH - Aachen und Dueren     Tel 0241/701333-0
ch at ...139...     Internet & Security for Professionals    Fax 0241/911879
           WESTEND ist CISCO Systems Partner - Premium Certified




More information about the Snort-users mailing list