[Snort-users] Why Gibson scans don't register?

Ed Padin epadin at ...200...
Sun Jul 30 03:05:10 EDT 2000


The site you're talking about is http://grc.com

He does a scan of known/common services/ports only and I think he executes
his scan kinda slow. It may fall within the threshold set in the scan
preprocessor assuming you're using it. If you're not using it, then that
would also explain the lack of alerts. If you tested the shields you'd get a
NetBIOS probe. I think there's a rule for that but it would trigger like
crazy anyway. NetBIOS probes are for windows like.... farts are for people. 

>-----Original Message-----
>From: Don Heffernan [mailto:donheff at ...88...]
>Sent: Saturday, July 29, 2000 9:54 AM
>To: snort-users at lists.sourceforge.net
>Subject: [Snort-users] Why Gibson scans don't register?
>
>
>I have been running Snort for a few days and it registers a 
>fair nyumber
>of port scans each day, as well as a variety of specific attemts (e.g,
>wingate).  I went to Gibson's Shields up site and had it run its port
>scan and it's probes and didn't get an alert from Snort.  Any thoughts
>on why that would be so?
>
>--
>Don Heffernan
>heffernan.cais.net
>
>
>
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>http://lists.sourceforge.net/mailman/listinfo/snort-users
>




More information about the Snort-users mailing list