[Snort-users] Uh-oh... bad ftp login

Jan Muenther jan at ...206...
Mon Oct 30 10:01:08 EST 2000


Hi Mikael,

> how do you start snort? do you start it with -s? if you don't, that's the
> reason why you can't find anything in secure or messages, snort doesn't log
> to syslog per default.

you obviously misunderstood me. Usually, when I get a bad ftp
login alert in my snort logs, I have a corresponding entry in the
"local" logfiles of my ftp server. I can only recall this
happening once. This time, I cannot find any entries on my ftp
host, but neither do I find any irregularities. Still, it makes
me kind of nervous.

I know about snort's logging options ;o))

Thanks, still.

Cheers, Jan
-- 
Radio HUNDERT,6 Medien GmbH Berlin
- EDV -
j.muenther at ...206...



More information about the Snort-users mailing list